Read
Returns data and changes nothing. Executes directly under the caller's permissions.
Governed capabilities your agents can call.
Aevah is an MCP-compatible tool host for enterprise agents. The same capabilities. The same governance. No privileged path.
One surface, one set of rules
Agents use the same governed capabilities as people.
Every capability in Aevah — search, match, quality, stewardship, publication — is published as a versioned, schema-bound, permission-scoped tool that agents discover and call. Whether a person clicks it in the interface or an agent invokes it over MCP, it is the same capability under the same governance. There is no privileged path for agents.
Agent-navigable website
Structured for agents browsing on your behalf.
The site itself is agent-navigable. Aevah's documentation and capability information are exposed as WebMCP tools, so an agent browsing on your behalf can search the documentation, retrieve capability and security detail, and prepare a demo request for you to review — without scraping pages or guessing at structure. The Aevah application exposes the same kind of surface: an agent working alongside a person can search, inspect and propose, while anything consequential stays a human decision.
Review the Aevah MCP surface →MCP Apps
Human decisions return a usable review surface.
When an agent reaches a decision only a person should make, Aevah hands back a usable interface rather than a wall of JSON. An agent proposing a merge returns a review surface showing the candidate records side by side, which attribute value wins and why, and approve or reject controls — rendered directly in the agent's own environment. The person decides on real evidence, in context, and the decision is captured in the audit trail. The interface is a rendering surface, never an authority: every approval is reauthorized against the approver's permissions before anything changes, and the surface never receives values the viewer is not cleared to see. Review surfaces cover merge and match review, survivorship explanation, data quality triage, mapping suggestion review, and generic proposal approval.
- 01Propose
- 02Review
- 03Approve
- 04Audit
Governed action
Three classes of tool.
Propose
Produces a change proposal for a human to approve. Nothing changes until a person with the required authority approves it. Most agent-initiated change belongs here.
Execute
Performs a governed change under explicit prior confirmation, reauthorized at the moment it runs. Confirmation is single-use, bound to the specific operation, and cannot be reused or broadened.
An agent cannot promote itself between classes.
Tool families
The enterprise capability surface.
Catalog discovery
Returns the tools, versions, classifications, and permissions available to the caller.
Data navigation
Returns authorized entities, relationships, definitions, and business context.
Quality intelligence
Returns quality standards, failed checks, affected records, and supporting evidence.
Matching and survivorship insight
Returns candidate records, comparisons, proposed outcomes, and the evidence available for review.
Governance memory
Returns definitions, policies, ownership, decisions, approvals, and audit history.
Publication and activation
Returns publication status, eligible targets, activation outcomes, and correlation identifiers.
Operations
Returns operation status, progress, cancellation state, and per-record outcomes.
Identity and authority
Agents inherit your rules, not new ones.
Every tool call carries the identity of whoever triggered it and can never exceed that identity's permissions. Sensitivity classification is honored on the way out, so a tool returns only what its caller is cleared to see. Actions that change data are recorded as new versions rather than overwrites, are safe to retry without duplicating work, and leave a complete audit trail — who acted, which tool, which version, what happened.
Review identity, authorization, isolation, and audit →Stable contracts
Contracts don't move underneath you.
Tools are versioned. A breaking change publishes a new version; the existing one is never altered. Agents built against a supported version keep working exactly as before, and deprecation is signalled in advance with a replacement pointer.
A governed change, end to end
A governed change follows one visible path.
- 01Agent proposes
- 02Steward reviews in Aevah
- 03Approved and executed under confirmation
- 04New version and audit record
This arc is the same whether the change originates with a person or an agent.
Complete history
Nothing is ever overwritten.
Governed changes are immutable and cumulative. Every change creates a new version; prior versions stay retrievable and comparable. Reverting moves forward — a prior version is reinstated by superseding the current one, so the record of what changed and what was undone survives intact. There is no destructive rollback, by design.
A practical next step
Request the security and integration detail pack.
Full control and integration detail is provided during RFP and pilot.
Request the detail pack