Adam Governed Querying
Adam lets users ask questions and perform work through Eve-managed resources without bypassing endpoint permissions. The goal is to make AI access useful while keeping the same access boundary that governs direct API and gateway traffic.
Querying Model
Adam should answer questions with the user's effective permissions:
If the user cannot read an endpoint through Eve, Adam should not use that endpoint to answer the question.
What Adam Can Query
Adam can work with Eve-managed resources such as:
- database endpoints,
- HTTP endpoints,
- model endpoints,
- endpoint tools,
- workflows,
- templates,
- and saved conversation context.
The exact actions depend on the endpoint type and the user's data-plane permission.
Model selection is also governed. Adam may use different model routes for summarization, deep reasoning, local/private execution, or tool-heavy work, but those routes are resolved through Eve-managed model endpoints and do not change the user's endpoint permissions.
Query Safety Rules
Use these rules when exposing Adam to customers:
- Start with read-only access unless the workflow needs writes.
- Treat generated SQL, commands, or tool calls as untrusted until Eve checks permissions.
- Keep mutation tools separate from read tools.
- Require approval for destructive or high-impact actions.
- Log which endpoint, tool, and subject were involved.
- Redact or avoid storing sensitive results when policy requires it.
Common Workflows
| Workflow | Adam behavior | Eve responsibility |
|---|---|---|
| Ask a data question | Generate or select a query/tool call. | Confirm endpoint access and execute through the configured endpoint. |
| Compare systems | Query multiple endpoints and summarize differences. | Enforce access to every endpoint independently. |
| Investigate incident | Pull endpoint metrics, errors, traces, and related context. | Provide telemetry and audit trails. |
| Prepare a migration | Inspect source and target readiness. | Govern endpoints, migration workflow access, and telemetry. |
Customer Readiness Checklist
Before enabling Adam querying:
- endpoints are configured and healthy,
- users have explicit data-plane grants,
- denied endpoints are tested,
- sensitive data handling is configured,
- tool execution metrics are exported,
- and operators know where Adam actions appear in logs or audit views.