Secure Enterprise AI
Secure Enterprise AI
AI for Enterprise Architecture With Security Built Into the Query
AI for enterprise architecture should make complex architecture and process information easier to use without creating a new path around the controls that protect it. GlobeArc lets authenticated users work with compatible AI assistants to ask questions about connected enterprise data in plain English, while the platform controls how those requests are translated, validated, authorized, and executed.
Through GlobeArc's generally available Model Context Protocol, or MCP, capability, organizations can connect AI-assisted workflows to architecture information in their workspace. The important distinction isn't simply that GlobeArc supports AI. It's that AI access is designed around validated queries, authenticated users, scoped permissions, and controlled pathways rather than giving an AI agent direct database access.
How Can AI Be Used in Enterprise Architecture?
Enterprise architecture contains a large amount of connected information, but getting an answer can require knowing where that information lives, how the metamodel is structured, and how different objects relate. AI can reduce that barrier by letting people start with the business question rather than the mechanics of retrieving the data.
With GlobeArc, an AI assistant can work with connected information across applications, capabilities, processes, stakeholders, organizational structures, and other enterprise domains. That makes it possible to ask questions that cross the usual boundary between Enterprise Architecture and Business Process Management instead of treating each area as a separate dataset.
- Which applications support this business capability?
- What depends on this application?
- Which organizational units perform this capability?
- Which processes are connected to this application?
- Where does this object appear elsewhere in the architecture?
- What architecture information exists for a particular state?
- Which relationships connect these parts of the organization?
Because the answers come from the connected repository, AI can work with relationships across applications, capabilities, processes, stakeholders, organizational structures, and other architecture information rather than treating each domain as an isolated dataset.
What is MCP in Enterprise Architecture Software?
Model Context Protocol, or MCP, is an open protocol that provides a standardized way for AI applications to connect to external tools and data sources. In GlobeArc, MCP provides a controlled interface through which compatible AI assistants can interact with architecture capabilities without connecting directly to the underlying database.
MCP itself isn't the security model. The controls surrounding the connection matter. GlobeArc combines MCP with authenticated access, OAuth scopes, validated query structures, and existing workspace permissions so that connecting an AI assistant doesn't mean bypassing the platform's authorization model. MCP authorization standards support bearer-token validation and scope-based access control, which provides the foundation for restricting what authenticated clients can access.
How Does GlobeArc Prevent AI From Executing Unsafe Database Queries?
GlobeArc doesn't give an AI assistant a database connection and ask it to generate SQL. Instead, architecture queries pass through the same controlled query architecture used by the platform.
The AI provides a structured request using GlobeArc's supported query model. That request is represented as a validated Abstract Syntax Tree, or AST, which defines the operations the query is allowed to perform. GlobeArc validates the structure before the query reaches the underlying data.
This separation creates several important safeguards:
- AI doesn't generate raw SQL for execution against the repository.
- The MCP service doesn't connect directly to the database.
- Queries must conform to GlobeArc's supported query structure.
- Authentication and authorization remain part of the request.
- Query access can be restricted independently through OAuth scopes.
- Workspace and tenant boundaries continue to apply.
The result is a narrower, more predictable interface between an AI assistant and enterprise architecture data.
Why Does Read-Only AI Access Matter?
GlobeArc can contain detailed information about critical applications, business processes, organizational dependencies, technology relationships, strategic initiatives, and other sensitive enterprise structures. In aggregate, that connected information can reveal far more about how an organization operates than any individual record.
Read-only query access reduces the potential impact of an AI interaction. An assistant can help retrieve and interpret architecture information without receiving general permission to modify the underlying repository.
This is also why GlobeArc separates querying from AI-assisted modeling. Reading architecture data and proposing a new process model are different actions, and they shouldn't automatically receive the same permissions.
Can AI Securely Query Connected Enterprise and Process Data?
GlobeArc's MCP query pathway is designed as read-only access. An authenticated user or AI client can't turn a query request into an unrestricted write operation simply because the user's normal GlobeArc role permits editing elsewhere in the platform. The dedicated query scope limits what the MCP connection is authorized to do. Authentication establishes who is making the request, while scopes and GlobeArc's existing authorization controls determine what that request is allowed to access. This approach follows the broader MCP authorization model, where protected resources can validate bearer tokens and require specific scopes before allowing operations.
Authentication Doesn't Replace Authorization
A valid login alone shouldn't provide unrestricted access to architecture data. GlobeArc continues to enforce tenant boundaries and application permissions when architecture information is accessed through MCP. That means AI becomes another controlled way to interact with GlobeArc rather than a separate access path around it. The assistant works within the authenticated context instead of receiving a universal view of every workspace or every piece of architecture information.
Can Organizations Bring Their Preferred AI Assistant?
GlobeArc's MCP approach separates the architecture platform from the AI client. Rather than requiring organizations to use a single embedded assistant, compatible MCP clients can connect to the controlled GlobeArc interface. This gives organizations more flexibility over the AI experience they choose while keeping GlobeArc responsible for the architecture-side controls. The AI assistant can change without requiring the organization to redesign how the underlying architecture repository is queried.
How Does Generative AI Support BPMN Process Modeling?
AI can also help accelerate process modeling. GlobeArc supports generating BPMN process models from natural-language descriptions, giving process teams a starting point that can be reviewed and refined rather than requiring every diagram to begin with an empty canvas. The generated model isn't silently persisted as authoritative architecture. Users can review, edit, save, or discard the proposed process, and the model passes through GlobeArc's process validation before it becomes part of the repository. This makes generative BPMN useful as an assisted modeling pathway rather than an autonomous process-design mechanism. Inside GlobeArc, choose "Generate from description" from the New Business Process menu, or use a compatible AI assistant connected through MCP.
Can Users Ask Questions Inside GlobeArc?
Yes. The Ask feature inside GlobeArc lets users ask questions about their workspace in plain English without leaving the platform. Teams can use whichever works best: Ask inside GlobeArc, or their company’s own AI assistant, such as Claude, Copilot, or Gemini, connected through MCP.
How is AI-Assisted Modeling Different From Read-Only Querying?
This distinction is central to GlobeArc's AI architecture. Asking a question and creating a process model don't carry the same risk, so they don't use the same permission pathway.
The standard MCP query surface is read-only. It can retrieve architecture information through the validated query architecture, but it doesn't gain write access because the authenticated user happens to have editing permissions elsewhere.
In practical terms:
- Read-only querying retrieves architecture information.
- Query access uses a dedicated read scope.
- Queries use the validated AST rather than raw SQL.
- Process-model creation requires a separate permission.
- Generated process models are validated before persistence.
- General repository write access isn't exposed through the query pathway.
Keeping these pathways separate allows GlobeArc to support useful agentic AI scenarios without treating every AI connection as an all-purpose architecture administrator.
How Can AI Help Compare Architecture Models?
AI-assisted work becomes more useful when it can help interpret change across both architecture and process information, not just retrieve individual records. GlobeArc already represents planning context such as Current, Interim, and Target states, giving AI-assisted workflows structured information for investigating how the enterprise changes over time.
For process architecture, GlobeArc’s Compare Models feature compares two BPMN models, such as Current and Target, or a location’s variant against the global standard. Teams choose one of three strategies: Deterministic, AI, or Hybrid, which runs the deterministic comparison first and then AI. The results highlight matched, renamed, changed, added, and removed elements, so no one has to compare diagrams by eye.
AI assistance doesn't replace the underlying comparison logic. GlobeArc provides the structured architecture and controlled access, while the assistant helps make the resulting information easier to interrogate and understand.
What Makes GlobeArc's Approach to Enterprise Architecture AI Different?
The goal isn't to give AI the broadest possible access to enterprise architecture. It's to make architecture information easier to use while preserving clear boundaries around what an AI-assisted interaction can do.
GlobeArc's approach combines several controls:
- One connected architecture repository rather than disconnected AI data sources
- Plain-language access through compatible AI assistants
- Generally available MCP connectivity for GlobeArc workspaces
- Authenticated access using OAuth
- Dedicated scopes for different types of operations
- Read-only architecture querying
- Validated AST queries instead of AI-generated raw SQL
- Tenant and application permissions that remain enforced
- Separate authorization for process-model creation
- Validation before generated BPMN models are persisted
That architecture matters because secure enterprise AI isn't only about what an AI model can answer. It's also about what the AI is allowed to reach, how its requests are constrained, which operations it can perform, and whether existing enterprise controls remain in force when AI enters the workflow.
We’re here to help you bring clarity to complexity.