> For the complete documentation index, see [llms.txt](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/features/ai-agent-security/supported-entities.md).

# Supported Entities

Veza discovers and catalogs AI resources across your cloud environments as three entity types: **AI Agents** (orchestration agents that invoke models and take actions), **AI Models** (foundation and custom models), and **AI Tools** (knowledge bases, action groups, and prompt templates). Use these entities to analyze access paths, track permissions, and report on access compliance.

See [Entity reference by integration](#entity-reference-by-integration) for the complete list of all entity types discovered per platform.

## Entities by Type

The following tables summarize all discovered AI entity types grouped by their functional role.

### AI Agents & Bots

Orchestration engines that invoke models, call tools, and take autonomous actions using an assigned execution identity.

| Veza Entity                                          | Integration  |
| ---------------------------------------------------- | ------------ |
| Bedrock Agent                                        | AWS          |
| Bedrock AgentCore Runtime                            | AWS          |
| AI Foundry Agent                                     | Azure        |
| Enterprise Application (with agentic tag)            | Azure AD     |
| Vertex AI Reasoning Engine                           | Google Cloud |
| Copilot Studio Bot                                   | Microsoft    |
| M365 Declarative Agent                               | Microsoft    |
| OpenAI Assistant                                     | OpenAI       |
| Bot Definition (Agentforce Agents and Einstein Bots) | Salesforce   |
| ServiceNow AI Agent                                  | ServiceNow   |
| Workday AI Agent                                     | Workday      |
| LiteLLM Agent                                        | LiteLLM      |
| Anthropic Claude Managed Agent                       | Anthropic    |

### AI Models

Foundation, fine-tuned, and imported models used by agents to generate responses and perform reasoning.

| Veza Entity                          | Integration  |
| ------------------------------------ | ------------ |
| Bedrock Custom Model                 | AWS          |
| Bedrock Foundation Model             | AWS          |
| Bedrock Imported Model               | AWS          |
| AI Foundry Model Deployment          | Azure        |
| Vertex AI Foundation Model           | Google Cloud |
| Vertex AI Model                      | Google Cloud |
| Copilot Studio AI Model              | Microsoft    |
| OpenAI Model                         | OpenAI       |
| ServiceNow AI Model                  | ServiceNow   |
| LiteLLM Model                        | LiteLLM      |
| Anthropic Claude Managed Agent Model | Anthropic    |

### AI Tools

Knowledge bases, action groups, and prompt templates that agents use to interact with external systems and data sources.

| Veza Entity                         | Integration         |
| ----------------------------------- | ------------------- |
| Bedrock Action Group                | AWS                 |
| Bedrock Knowledge Base              | AWS                 |
| Bedrock Prompt                      | AWS                 |
| Bedrock Prompt Router               | AWS                 |
| Bedrock AgentCore Gateway           | AWS                 |
| Bedrock AgentCore Gateway Target    | AWS                 |
| Bedrock AgentCore Code Interpreter  | AWS                 |
| Bedrock AgentCore Browser           | AWS                 |
| AI Foundry Tool                     | Azure               |
| AI Foundry Vector Store             | Azure               |
| Vertex AI Endpoint                  | Google Cloud        |
| Public MCP Server                   | Public MCP Registry |
| OpenAI Vector Store                 | OpenAI              |
| ServiceNow AI Agent Tool            | ServiceNow          |
| ServiceNow Gen AI Skill             | ServiceNow          |
| Workday Agent Skill                 | Workday             |
| Workday MCP Tool                    | Workday             |
| LiteLLM MCP Server                  | LiteLLM             |
| Anthropic Claude Managed Agent Tool | Anthropic           |

## Capability coverage by platform

Veza models every supported platform consistently for **discovery and classification**: each agent is extracted as an AI Agent entity and classified as a non-human identity (NHI). How completely Veza links an agent to the **models, tools, and MCP servers it uses** varies by platform, because platforms differ in what their APIs expose about an agent's composition. Use this matrix for an at-a-glance view of what is available today. The per-platform sections under [Entity reference by integration](#entity-reference-by-integration) describe each relationship in detail.

| Platform                            | Discovery & NHI classification | Model links | Tool links | MCP server links |
| ----------------------------------- | :----------------------------: | :---------: | :--------: | :--------------: |
| AWS Bedrock                         |                ✅               |      ✅      |      ✅     |         —        |
| AWS Bedrock AgentCore               |                ✅               |      —      |      —     |         —        |
| Azure AI Foundry                    |                ✅               |      ✅      |      ✅     |         —        |
| Microsoft Copilot Studio            |                ✅               |      ✅      |      ✅     |         ✅        |
| Microsoft 365 Copilot Agent Builder |                ✅               |      —      |      —     |         —        |
| Google Cloud Vertex AI              |                ✅               |      —      |      —     |         —        |
| OpenAI                              |                ✅               |      ✅      |      ✅     |         —        |
| Anthropic Claude                    |                ✅               |      ✅      |      ✅     |         ✅        |
| Salesforce (Agentforce)             |                ✅               |      —      |      —     |         —        |
| ServiceNow                          |                ✅               |      —      |      ✅     |         —        |
| Workday                             |                ✅               |      —      |      ✅     |         —        |

**Key:** ✅ Veza models a direct, queryable link from the agent to entities of this type. — Not currently modeled. **Tool links** cover the tools, knowledge bases, and vector stores an agent uses. Some links require the related integration or data source to be enabled — for example, Microsoft Copilot Studio MCP server links require the [Public MCP Registry](#public-mcp-registry) data source, and Anthropic links require the Admin Platform data source. See each platform's section for prerequisites.

**Coverage notes:**

* **AWS Bedrock AgentCore** — runtimes are packaged as container images. The models and tools an agent uses are defined in the agent's code and are not associated with the runtime by the AgentCore APIs. AgentCore gateways, code interpreters, and browsers are still discovered as separate resources.
* **Azure AI Foundry** — MCP-backed tools are discovered as AI Foundry tools rather than as distinct MCP server entities.
* **Google Cloud Vertex AI** — Vertex does not expose an agent's model, tools, or MCP servers through its API; these are configured in the packaged agent application.
* **Microsoft 365 Copilot Agent Builder** — declarative agents run on the shared Microsoft 365 Copilot model. The Package Management API surfaces an agent's capabilities and knowledge sources as manifest attributes rather than as distinct model, tool, or MCP server entities.
* **Salesforce (Agentforce)** — model selection is org-level, so models link to the Salesforce organization rather than to individual agents.
* **ServiceNow** — generative AI models bind to platform-level Gen AI configurations rather than to individual agents.

### Related capabilities

This matrix covers discovery and the AI supply chain — the models, tools, and MCP servers an agent uses. The rest of an agent's profile is covered elsewhere on this page and in the overview:

* **Access modeling** — who can access each agent, and what each agent can reach — is described in the **Permissions model** notes for each platform under [Entity reference by integration](#entity-reference-by-integration) and summarized in [Access paths and relationships](#access-paths-and-relationships). Veza models an agent's own **ambient** access separately from **delegated**, on-behalf-of-user access (see [AI Agents](#ai-agents)).
* **Ownership** — owners can be assigned to agents for governance accountability (see [Ownership](/4yItIzMvkpAvMVFAamTf/features/ai-agent-security.md#ownership)). Microsoft Copilot Studio also derives an owner from the platform automatically.

## AI Agents

Veza discovers AI Agents across AWS Bedrock, AWS Bedrock AgentCore, Google Cloud Vertex AI, Microsoft Copilot Studio, Microsoft 365 Copilot Agent Builder, Azure AI Foundry, OpenAI, Anthropic Claude, LiteLLM, Salesforce, ServiceNow, and Workday, enabling you to track which agents can access sensitive data, analyze their permission scope, and enforce governance policies.

AI Agents combine language models with the ability to take actions, such as tool calling and API execution, multi-step reasoning and decision-making, access to databases, APIs, and file systems, and IAM role assumption for resource access.

Veza models two distinct access patterns for AI Agents:

* **Ambient permissions** — The agent acts as its own principal using an assigned IAM role, service account, or managed identity to access resources directly. These permissions exist regardless of who invokes the agent.
* **Delegated permissions** — The agent acts on behalf of an invoking user, inheriting that user's permission scope for downstream resource access. What the agent can reach depends on who triggered it.

Both patterns appear in the Veza graph, enabling you to answer questions like "What resources can this agent access on its own?" and "What can a user access through this agent that they couldn't access directly?"

Example queries:

* "show me bedrock agents with iam roles that can access rds databases"
* "which ai agents can read s3 buckets with pii tags"
* "find agents using claude opus without assigned owners"
* "bedrock agents created in last 30 days"

Veza discovers the following AI Agent types:

* **AWS Bedrock**: Bedrock Agent (`BedrockAgent`)
* **AWS Bedrock AgentCore**: Bedrock AgentCore Runtime (`BedrockAgentCoreRuntime`)
* **Google Cloud Vertex AI**: Vertex AI Reasoning Engine (`VertexAiReasoningEngine`)
* **Microsoft Copilot Studio**: Copilot Studio Bot (`MicrosoftCopilotStudioBot`)
* **Azure AI Foundry**: Azure AI Foundry Agent (`AzureAiFoundryAgent`, `AzureAiFoundryBotServiceAgent`)
* **OpenAI**: OpenAI Assistant (`OpenAIAssistant`)
* **Anthropic**: Anthropic Claude Managed Agent (`AnthropicClaudeManagedAgentAgent`)
* **Salesforce**: Salesforce Bot Definition (`SalesforceBotDefinition`)
* **LiteLLM**: LiteLLM Agent (`LiteLLMAgent`)
* **ServiceNow**: ServiceNow AI Agent (`ServiceNowAIAgent`)
* **Workday**: Workday AI Agent (`WorkdayAIAgent`)

### AI Agent Properties

All AI agent entities include standard attributes for filtering and analysis:

| Property            | Description                                         | Example Values                                                                              | Availability                                                                                                                                    |
| ------------------- | --------------------------------------------------- | ------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| **AI Platform**     | The hosting platform where the agent runs           | AWS Bedrock, Google Cloud Vertex AI, Microsoft Copilot Studio, Azure AI Foundry, Salesforce | All platforms                                                                                                                                   |
| **Publisher**       | Organization that created the underlying technology | Amazon, Google, Microsoft, Salesforce                                                       | All platforms                                                                                                                                   |
| **Entity Type**     | Graph category for search and filtering             | AI Agent, AI Model, AI Tool                                                                 | All platforms                                                                                                                                   |
| **Name**            | Human-readable agent name                           | support-bot-v2, financial-analyst                                                           | All platforms                                                                                                                                   |
| **Status**          | Current operational state                           | See [Agent Status Values](#agent-status-values) below                                       | AWS Bedrock and AWS Bedrock AgentCore (see values below). Other platforms report an enabled or disabled state through the `is_active` property. |
| **IAM Role**        | Associated execution role                           | arn:aws:iam::123456789012:role/veza-bedrock-agent-role                                      | AWS Bedrock and AWS Bedrock AgentCore                                                                                                           |
| **Service Account** | Associated service account                          | `my-agent@project.iam.gserviceaccount.com`                                                  | Google Cloud Vertex AI only                                                                                                                     |

#### Agent Status Values

AWS Bedrock agents report the following status values:

| Status         | Description                    | When This Occurs                                             |
| -------------- | ------------------------------ | ------------------------------------------------------------ |
| `PREPARED`     | Agent is ready for use         | Configuration complete, all dependencies available           |
| `NOT_PREPARED` | Agent configuration incomplete | Missing action groups, knowledge bases, or model selection   |
| `PREPARING`    | Agent is being prepared        | Transitioning to ready state after `PrepareAgent` API call   |
| `CREATING`     | Agent is being provisioned     | During initial creation                                      |
| `UPDATING`     | Agent is being updated         | Configuration changes being applied                          |
| `VERSIONING`   | Agent version is being created | New version deployment in progress                           |
| `DELETING`     | Agent is being removed         | Deletion initiated but not yet complete                      |
| `FAILED`       | Agent encountered an error     | Configuration error, permission issue, or deployment failure |

AWS Bedrock AgentCore runtimes report a separate set of status values:

| Status          | Description                                                                 |
| --------------- | --------------------------------------------------------------------------- |
| `CREATING`      | Runtime is being provisioned.                                               |
| `CREATE_FAILED` | Runtime provisioning failed.                                                |
| `READY`         | Runtime is provisioned and ready to serve invocations. `is_active` is true. |
| `UPDATING`      | Runtime configuration is being updated.                                     |
| `UPDATE_FAILED` | Runtime update failed.                                                      |
| `DELETING`      | Runtime is being deleted.                                                   |

## AI Models

AI Models are the underlying machine learning models that power AI Agents and applications, including foundation models, LLMs, SLMs, and custom-trained variants.

AI Models in Veza include **Foundation models** (pre-trained models from major vendors), **Custom models** (fine-tuned or trained on specific data), and **Imported models** (third-party models hosted in your environment).

{% hint style="info" %}
Veza has a native [OpenAI integration](/4yItIzMvkpAvMVFAamTf/integrations/integrations/openai.md) that discovers project-level AI resources — including assistants (modeled as AI agents), models, files, and vector stores. OpenAI foundation models are also accessible for discovery when hosted via AWS Bedrock and Azure AI Foundry.
{% endhint %}

Veza organizes models using a three-level hierarchy for filtering and reporting:

* **Publisher level** - Filter by organization (Anthropic, OpenAI, Google, Meta, Amazon)
* **Model Family level** - Filter by model lineage (Claude, GPT, Llama, Gemini, Nova)
* **Model Series level** - Filter by capability tier (Opus, Sonnet, Haiku, Pro, Lite)

Veza tracks model usage and lifecycle status to enable:

* Model inventory and usage reporting
* Detection of deprecated or legacy models
* Cost optimization by identifying over-provisioned models
* Enforcement of approved model lists by team or application

Example queries:

* "foundation models with legacy lifecycle status"
* "bedrock agents using claude opus models"
* "custom models in production environment"
* "show model usage by publisher"

### AI Model Properties

All AI Models include detailed metadata for compliance and governance:

| Property              | Description                         | Example Values                                                                                                  |
| --------------------- | ----------------------------------- | --------------------------------------------------------------------------------------------------------------- |
| **AI Platform**       | Where the model is hosted           | AWS Bedrock, Google Cloud Vertex AI, Azure OpenAI                                                               |
| **Publisher**         | Organization that created the model | Anthropic, OpenAI, Google, Meta, Amazon, Microsoft, Mistral, Cohere, Stability AI, AI21 Labs, DeepSeek, Alibaba |
| **Model Family**      | High-level model lineage            | Claude, GPT, Llama, Gemini, Nova, Titan, Mistral, Command                                                       |
| **Model Series**      | Specific model variant              | Claude Opus, Claude Sonnet, GPT-4o, Llama 3.3, Nova Pro                                                         |
| **Lifecycle Status**  | Model availability                  | See [Model Lifecycle Status Values](#model-lifecycle-status-values) below                                       |
| **Streaming Support** | Real-time response capability       | true, false                                                                                                     |

#### Model Lifecycle Status Values

| Lifecycle Status | Description                              | Recommended Action                              |
| ---------------- | ---------------------------------------- | ----------------------------------------------- |
| `ACTIVE`         | Model is fully supported and available   | Safe to use in production                       |
| `LEGACY`         | Model is deprecated but still accessible | Plan migration to newer model series            |
| `SUNSET`         | Model scheduled for removal              | Migrate immediately to avoid service disruption |

Use Veza queries to identify agents using `LEGACY` or `SUNSET` models for proactive governance.

## AI Tools

AI Tools are resources that AI Agents invoke to access data and execute actions, including knowledge bases, action groups, prompt templates, and function calling endpoints.

AI Tools define agent capabilities and data access:

* **Knowledge Bases** - RAG data sources containing indexed documents
* **Action Groups** - APIs and functions agents can execute
* **Prompts** - Centrally managed, versioned prompt templates for consistent model interactions
* **Prompt Routers** - Route prompts to different models based on quality and cost criteria
* **MCP Servers** - External integrations and system connections from public MCP registries

Example queries:

* "knowledge bases connected to s3 buckets with pii"
* "action groups in enabled state"
* "bedrock agents using shared knowledge bases"
* "which agents can access customer-data knowledge base"

### AI Tool Properties

| Property          | Description                        | Example Values                              |
| ----------------- | ---------------------------------- | ------------------------------------------- |
| **AI Platform**   | Platform hosting the tool          | AWS Bedrock, MCP                            |
| **Publisher**     | Organization providing the tool    | Amazon, Microsoft, Custom                   |
| **Tool Subtypes** | Specific tool categories           | MCP\_SERVER, ACTION\_GROUP, KNOWLEDGE\_BASE |
| **State**         | Operational status (Action Groups) | ENABLED, DISABLED                           |

## Entity Reference by Integration

This section lists all entity types Veza discovers per integration, including supporting resources, policies, and guardrails beyond the primary agent, model, and tool types.

{% hint style="info" %}
All AI Agent entity types (agents, bots, and reasoning engines) are classified as non-human identities (NHI) by default. See [NHI Supported Entities](/4yItIzMvkpAvMVFAamTf/features/nhi/nhi-entities.md) for the complete list of entity types that Veza always classifies as non-human.
{% endhint %}

### AWS Bedrock

| Entity Type                      | Classification | Description                                                                                                                  |
| -------------------------------- | -------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| `BedrockAgent`                   | Resource       | Base agent definition and non-human identity; parent of agent versions and aliases. Assumes an IAM Role for resource access. |
| `BedrockAgentAlias`              | Resource       | Pointer to a specific agent version; used for versioned invocation.                                                          |
| `BedrockAgentVersion`            | AI Agent       | Primary orchestration engine; a pinned agent version that invokes models, runs Action Groups, and queries Knowledge Bases.   |
| `BedrockActionGroup`             | AI Tool        | Defines actions the agent can perform; backed by Lambda functions or OpenAPI schemas.                                        |
| `BedrockKnowledgeBase`           | AI Tool        | RAG-enabled data repository providing contextual information to agents.                                                      |
| `BedrockKnowledgeBaseDataSource` | Resource       | Connector to external systems (S3, SharePoint, Confluence, Salesforce) that feeds a Knowledge Base.                          |
| `BedrockFoundationModel`         | AI Model       | Pre-trained, on-demand models (Claude, Llama, Titan, GPT-4o, etc.) accessible via the Bedrock API.                           |
| `BedrockCustomModel`             | AI Model       | Fine-tuned models trained on private data; references a base Foundation Model.                                               |
| `BedrockImportedModel`           | AI Model       | Externally imported models (e.g., from SageMaker).                                                                           |
| `BedrockPrompt`                  | AI Tool        | Centrally managed, versioned prompt templates for consistent model interactions.                                             |
| `BedrockPromptVersion`           | Resource       | A specific version of a prompt template.                                                                                     |
| `BedrockPromptRouter`            | AI Tool        | Routes prompts to different models based on quality and cost criteria.                                                       |
| `BedrockGuardrail`               | Policy         | Content filtering and safety policy (topic, word, PII, and Automated Reasoning filters).                                     |
| `BedrockGuardrailVersion`        | Resource       | Versioned guardrail with detailed filter configurations.                                                                     |

**Permissions model:** Bedrock Agents assume IAM roles to access AWS services. Analyzing effective permissions requires reviewing IAM user and group policies, service role permissions, SCPs and RCPs, and resource-based policies on connected services (Lambda, S3, OpenSearch).

### AWS Bedrock AgentCore

Amazon Bedrock AgentCore is a managed infrastructure platform for deploying and running AI agents at production scale. Unlike Bedrock (classic), which provides managed orchestration for short-lived API calls, AgentCore provides long-running serverless compute for agents built with any framework (Strands, LangGraph, CrewAI, OpenAI Agents SDK, etc.) and any model. Veza discovers AgentCore resources and their IAM role associations as part of the AWS integration. For Bedrock agent definitions and associated models, see [AWS Bedrock](#aws-bedrock) above.

| Entity Type                              | Classification | Description                                                                                                             |
| ---------------------------------------- | -------------- | ----------------------------------------------------------------------------------------------------------------------- |
| `BedrockAgentCoreService`                | Service        | The AgentCore service instance within an AWS account. Parent of all AgentCore resources.                                |
| `BedrockAgentCoreRuntime`                | AI Agent       | A running agent instance on the AgentCore platform. Assumes an execution IAM role for downstream resource access.       |
| `BedrockAgentCoreRuntimeEndpoint`        | Instance       | A named, versioned invocation endpoint attached to a Runtime. Routes invocations to a specific version of the agent.    |
| `BedrockAgentCoreGateway`                | AI Tool        | A gateway that exposes tools/APIs that AgentCore agents can invoke, fronted by an invocation URL.                       |
| `BedrockAgentCoreGatewayTarget`          | AI Tool        | An individual tool/target exposed through a Gateway (e.g., an external API that agents can call).                       |
| `BedrockAgentCoreMemory`                 | AI Resource    | Managed long-term memory store that agents read from and write to.                                                      |
| `BedrockAgentCoreOnlineEvaluationConfig` | AI Resource    | Evaluation configuration that runs assessments against agent traffic in production. Assumes its own execution IAM role. |
| `BedrockAgentCoreCodeInterpreter`        | AI Tool        | Sandboxed code-execution environment that agents use to run generated code. Assumes an execution IAM role.              |
| `BedrockAgentCoreBrowser`                | AI Tool        | Sandboxed browser environment that agents use to interact with web pages. Assumes an execution IAM role.                |

**Properties:**

> Common properties that are inherited or derived at extraction time (`aws_account_id`, `aws_account_name`, `ai_platform`, `ai_agent_publisher` / `ai_tool_publisher`, `identity_type`, `identity_subtypes`, `is_active`) are omitted from the tables below. Each table lists only the properties populated from the entity's own AWS API response.

`BedrockAgentCoreService` has no entity-specific properties. This entity is synthesized per account to anchor the hierarchy in Access Graph.

`BedrockAgentCoreRuntime`:

| Property          | Description                                                                   |
| ----------------- | ----------------------------------------------------------------------------- |
| `runtime_id`      | AgentCore-assigned runtime identifier (required).                             |
| `description`     | Runtime description.                                                          |
| `status`          | Operational state reported by AgentCore (e.g., `READY`, `CREATING`).          |
| `role_arn`        | IAM role ARN the runtime assumes for downstream resource access.              |
| `authorizer_type` | Authorizer the runtime accepts on invocation (e.g., `CUSTOM_JWT`, `AWS_IAM`). |
| `protocol_type`   | Wire protocol exposed by the runtime (e.g., `HTTP`, `MCP`).                   |
| `created_at`      | Runtime creation timestamp.                                                   |
| `updated_at`      | Last modification timestamp.                                                  |

`BedrockAgentCoreRuntimeEndpoint`:

| Property          | Description                                                      |
| ----------------- | ---------------------------------------------------------------- |
| `endpoint_name`   | Endpoint name.                                                   |
| `endpoint_status` | Endpoint operational state.                                      |
| `live_version`    | Runtime version currently serving traffic through this endpoint. |
| `target_version`  | Runtime version the endpoint is targeting (for rollouts).        |
| `description`     | Endpoint description.                                            |
| `created_at`      | Endpoint creation timestamp.                                     |
| `updated_at`      | Last modification timestamp.                                     |

`BedrockAgentCoreGateway`:

| Property          | Description                                                  |
| ----------------- | ------------------------------------------------------------ |
| `gateway_id`      | AgentCore-assigned gateway identifier.                       |
| `description`     | Gateway description.                                         |
| `status`          | Operational state (e.g., `READY`).                           |
| `role_arn`        | IAM role ARN the gateway assumes when forwarding to targets. |
| `authorizer_type` | Authorizer required for gateway invocation.                  |
| `protocol_type`   | Wire protocol exposed by the gateway.                        |
| `gateway_url`     | Gateway invocation URL.                                      |
| `created_at`      | Gateway creation timestamp.                                  |
| `updated_at`      | Last modification timestamp.                                 |

`BedrockAgentCoreGatewayTarget`:

| Property      | Description                      |
| ------------- | -------------------------------- |
| `target_name` | Target display name.             |
| `status`      | Operational state of the target. |
| `description` | Target description.              |
| `created_at`  | Target creation timestamp.       |
| `updated_at`  | Last modification timestamp.     |

`BedrockAgentCoreMemory`:

| Property      | Description                           |
| ------------- | ------------------------------------- |
| `memory_id`   | AgentCore-assigned memory identifier. |
| `description` | Memory description.                   |
| `status`      | Operational state (e.g., `ACTIVE`).   |
| `created_at`  | Memory creation timestamp.            |
| `updated_at`  | Last modification timestamp.          |

`BedrockAgentCoreOnlineEvaluationConfig`:

| Property                        | Description                                       |
| ------------------------------- | ------------------------------------------------- |
| `description`                   | Evaluation config description.                    |
| `status`                        | Configuration state (e.g., `ACTIVE`).             |
| `execution_status`              | Runtime status of the evaluation workload itself. |
| `evaluation_execution_role_arn` | IAM role ARN the evaluation assumes when running. |
| `created_at`                    | Evaluation config creation timestamp.             |
| `updated_at`                    | Last modification timestamp.                      |

`BedrockAgentCoreCodeInterpreter`:

| Property             | Description                                                               |
| -------------------- | ------------------------------------------------------------------------- |
| `interpreter_type`   | Interpreter variant (e.g., `PUBLIC`, `CUSTOM`).                           |
| `description`        | Interpreter description.                                                  |
| `status`             | Operational state (e.g., `READY`).                                        |
| `execution_role_arn` | IAM role ARN the interpreter assumes when executing agent-submitted code. |
| `created_at`         | Interpreter creation timestamp.                                           |
| `updated_at`         | Last modification timestamp.                                              |

`BedrockAgentCoreBrowser`:

| Property             | Description                                                       |
| -------------------- | ----------------------------------------------------------------- |
| `browser_type`       | Browser variant (e.g., `PUBLIC`, `CUSTOM`).                       |
| `description`        | Browser description.                                              |
| `status`             | Operational state (e.g., `READY`).                                |
| `execution_role_arn` | IAM role ARN the browser assumes when interacting with web pages. |
| `created_at`         | Browser creation timestamp.                                       |
| `updated_at`         | Last modification timestamp.                                      |

**Permissions model:** AgentCore resources assume IAM roles to access resources. Veza creates a `CAN_ASSUME_ROLE` relationship connecting each Runtime, Gateway, Online Evaluation Config, Code Interpreter, and Browser to its associated IAM role. Then, effective permissions are resolved across downstream AWS services through the IAM integration. IAM must be enabled in the same AWS integration for role linking to function.

### Azure AD (Entra ID)

No new entity type is created. The existing `AzureADEnterpriseApplication` entity receives `identity_subtypes: ["AI_AGENT"]` when the platform-native field indicates an AI agent.

| Entity Type                    | Classification condition                                                                                   |
| ------------------------------ | ---------------------------------------------------------------------------------------------------------- |
| `AzureADEnterpriseApplication` | Application tags include `AgenticInstance`, `AgenticApp`, or any tag prefixed with `power-virtual-agents-` |

### Azure AI Foundry

| Entity Type                     | Classification  | Description                                                                                                          |
| ------------------------------- | --------------- | -------------------------------------------------------------------------------------------------------------------- |
| `AzureAiFoundryAgent`           | AI Agent        | An AI agent or assistant created in Azure AI Foundry; backed by a model deployment.                                  |
| `AzureAiFoundryBotServiceAgent` | Service Account | Service account identity for an AI Foundry agent deployed via Azure Bot Service to channels (Teams, Web Chat, etc.). |
| `AzureAiFoundryService`         | Service         | The Azure AI Foundry service instance within a subscription.                                                         |
| `AzureAiFoundryAccount`         | Resource        | An AI Foundry account (hub) grouping projects and resources.                                                         |
| `AzureAiFoundryProject`         | Resource        | A project workspace within an AI Foundry account.                                                                    |
| `AzureAiFoundryModelDeployment` | AI Model        | A deployed model endpoint (e.g., GPT-4o, Claude) used by agents.                                                     |
| `AzureAiFoundryVectorStore`     | Resource        | Vector store for RAG-based knowledge retrieval.                                                                      |
| `AzureAiFoundryConnection`      | Resource        | External service connection (e.g., to Azure OpenAI, Cognitive Search).                                               |
| `AzureAiFoundryTool`            | AI Tool         | Tool definition available to agents (e.g., code interpreter, function call).                                         |
| `AzureAiFoundryIndex`           | Resource        | Search index backing a knowledge source.                                                                             |
| `AzureAiFoundryGuardRail`       | Policy          | Content safety and moderation policy applied to agent interactions.                                                  |

**Properties:**

Azure AI Foundry Agent:

| Property                        | Description                                                                                                                             |
| ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| `agent_kind`                    | Agent type: `prompt`, `workflow`, `hosted`, or `container_app`                                                                          |
| `is_published`                  | Whether the agent is published as an Agent Application. Recorded for every agent as `true` or `false`.                                  |
| `agent_identity_id`             | The Microsoft Entra agent identity the agent runs as. Distinct for a published agent; shared with the project for an unpublished agent. |
| `agent_identity_blueprint_id`   | The agent identity blueprint that governs the agent identity.                                                                           |
| `managed_identity_principal_id` | The managed identity of the agent's project. Recorded for unpublished agents.                                                           |

**Microsoft Entra agent identities:**

Foundry agents run as Microsoft Entra Agent ID objects rather than as their project's managed identity:

* **Agent identity** — The service principal an agent runs as. It holds the Azure RBAC assignments that determine what the agent can reach.
* **Agent identity blueprint** — The application that governs a class of agent identities. It establishes lineage, not access.
* **Project managed identity** — The identity shared by a Foundry project. Veza links an agent to it only when the agent has no agent identity of its own, as in tenants that predate Entra Agent ID.

Whether an agent is published determines which identity it uses:

* **Published agents** (`is_published: true`) each have a distinct agent identity and blueprint, taken from the agent's Agent Application. A published agent is not linked to its project's managed identity.
* **Unpublished agents** (`is_published: false`) share the default agent identity and blueprint of their project.

Agent identities and blueprints are Entra ID directory objects, discovered by the Azure integration as `AzureADEnterpriseApplication` entities. See [Azure AD (Entra ID)](#azure-ad-entra-id) for how Veza classifies these entities as AI agents.

**Permissions model:** Agents use Azure RBAC through the Microsoft Entra agent identity they run as. Veza creates an `ASSUMES_USER` relationship from each agent to its agent identity, resolving the agent's effective permissions on downstream Azure resources through that identity. This relationship appears in both the effective permissions and system permissions views. For an agent with no agent identity of its own, Veza creates the same relationship to the project's managed identity instead. A **Has agent blueprint** (`HAS_AGENT_BLUEPRINT`) relationship links each agent to its blueprint. Because a blueprint governs an agent identity rather than granting access through it, this relationship is excluded from effective permissions and appears only in the system permissions view.

{% hint style="info" %}
Publishing state and per-agent identities come from the Microsoft Agent Applications API, which Microsoft ships as a preview API. When it is unavailable, agents keep the agent identity of their project and Veza records the resource as skipped. Extraction of the remaining Foundry entities is unaffected.
{% endhint %}

{% hint style="warning" %}
**Classic portal agents are not supported.** Veza only extracts agents created in the new [Azure AI Foundry portal](https://ai.azure.com). Agents created in the Foundry (classic) portal are not discovered. Microsoft has announced that the Foundry classic portal and classic Agents will be retired on **March 31, 2027**, and that the Assistants API backend powering many classic agents will sunset on **August 26, 2026**.
{% endhint %}

### Google Cloud Vertex AI

| Entity Type               | Classification | Description                                                                                            |
| ------------------------- | -------------- | ------------------------------------------------------------------------------------------------------ |
| `VertexAiReasoningEngine` | AI Agent       | Stateful orchestration engine; executes custom code and tools. Runs as a Google Cloud service account. |
| `VertexAiService`         | Service        | The Vertex AI service instance within a Google Cloud project.                                          |
| `VertexAiFoundationModel` | AI Model       | Pre-trained foundation models available in Vertex AI (Gemini, etc.).                                   |
| `VertexAiModel`           | AI Model       | Custom tuned models in the Vertex AI Model Registry.                                                   |
| `VertexAiEndpoint`        | Resource       | Deployed model endpoint serving predictions; invoked by agents as functional tools.                    |
| `VertexAiPolicy`          | Policy         | IAM policies applied to Vertex AI resources.                                                           |
| `VertexAiRoleBinding`     | Resource       | IAM role bindings granting identities access to Vertex AI resources.                                   |

**Permissions model:** Veza links each Reasoning Engine to its Google Cloud service account through a transitive `USES_SERVICE_ACCOUNT` relationship, so the agent inherits the access granted to that service account. Its ambient permissions resolve across downstream Google Cloud resources through the service account, which requires the Google Cloud IAM data source to be enabled in the same integration.

{% hint style="warning" %}
Veza cannot link Vertex AI agents to the foundation models they use. Google Vertex AI does not expose this information via API.
{% endhint %}

### OpenAI

Discovered by the native [OpenAI integration](/4yItIzMvkpAvMVFAamTf/integrations/integrations/openai.md) at the project data source level.

| Entity Type         | Classification | Description                                                              |
| ------------------- | -------------- | ------------------------------------------------------------------------ |
| `OpenAIAssistant`   | AI Agent       | An assistant created in an OpenAI project; backed by a model.            |
| `OpenAIModel`       | AI Model       | A model available to the project.                                        |
| `OpenAIVectorStore` | Resource       | Vector store for retrieval-based knowledge; may be used by assistants.   |
| `OpenAIFile`        | Resource       | A file uploaded to the project; may back a vector store or an assistant. |

**Permissions model:** Access to project resources is derived by joining organization membership (users, service accounts, groups) to project resources via a cross-service connection. Both the organization and project data sources must be active for these access relationships to appear.

### Anthropic (Claude Admin Platform)

Veza discovers Anthropic Claude managed agents and their supporting resources inside each Anthropic workspace, along with the organization, workspaces, users, and API keys of the Anthropic Admin Platform. Discovery is part of the [Anthropic Claude Admin Platform integration](/4yItIzMvkpAvMVFAamTf/integrations/integrations/anthropic.md) and uses two data sources: the Admin Platform data source (organization structure and credentials) and a per-workspace Managed Agents data source (agents, models, tools, and supporting resources).

| Entity Type                                | Classification   | Description                                                                                                              |
| ------------------------------------------ | ---------------- | ------------------------------------------------------------------------------------------------------------------------ |
| `AnthropicClaudeManagedAgentAgent`         | AI Agent         | A managed agent in a workspace. Backed by a Claude model. Calls tools and MCP servers, and can delegate to other agents. |
| `AnthropicClaudeManagedAgentModel`         | AI Model         | A Claude model available to agents in the workspace.                                                                     |
| `AnthropicClaudeManagedAgentTool`          | AI Tool          | A tool an agent can call, exposed by an MCP server.                                                                      |
| `AnthropicClaudeManagedAgentMCPServer`     | Resource         | An MCP server that exposes tools to agents (synthesized from agent configuration).                                       |
| `AnthropicClaudeManagedAgentEnvironment`   | Resource         | An agent execution environment (networking and host allowlist configuration).                                            |
| `AnthropicClaudeManagedAgentVault`         | Resource         | A workspace vault holding secrets an agent can access.                                                                   |
| `AnthropicClaudeManagedAgentSkill`         | Resource         | An agent skill. Discovered only for workspaces enrolled in Anthropic's managed agent skills beta.                        |
| `AnthropicClaudeAdminPlatformOrganization` | Resource         | The top-level Anthropic organization.                                                                                    |
| `AnthropicClaudeAdminPlatformWorkspace`    | Resource         | A workspace that segments projects and access within the organization.                                                   |
| `AnthropicClaudeAdminPlatformUser`         | User             | An organization member with organization and workspace role assignments.                                                 |
| `AnthropicClaudeAdminPlatformAPIKey`       | Credential (NHI) | A workspace-scoped API key, surfaced as a non-human identity.                                                            |

**Permissions model:** A managed agent is its own non-human principal and does not assume a human user. Veza models the agent's ambient access to the workspace resources it uses: calling tools (`CAN_INVOKE`), reaching MCP servers (`CAN_ACCESS`), reading vaults (`CAN_ACCESS_VAULT`), and using skills (`CAN_USE`). Structural relationships connect coordinator agents to the agents they delegate to (`DELEGATES_TO`), each agent to the Claude model it uses (`USES_MODEL`), and each tool to the MCP server that exposes it (`EXPOSED_BY`). Organization members and API keys hold management-level privileges on these resources, derived by joining workspace membership from the Admin Platform data source. Both the Admin Platform and Managed Agents data sources must be active for workspace access relationships to appear.

See the [Anthropic Claude Admin Platform integration guide](/4yItIzMvkpAvMVFAamTf/integrations/integrations/anthropic.md#workspace-level-entity-discovery-managed-agents) for the full list of entity attributes, roles, and setup.

### LiteLLM

Veza discovers the agents, model routes, and MCP servers of a self-hosted [LiteLLM AI Gateway](/4yItIzMvkpAvMVFAamTf/integrations/integrations/litellm.md), along with the organizations, teams, users, and virtual keys that govern who can reach them. The gateway fronts many model providers behind one API, so its allow-lists and access groups decide which principals can reach which providers.

| Entity Type           | Classification   | Description                                                                                                      |
| --------------------- | ---------------- | ---------------------------------------------------------------------------------------------------------------- |
| `LiteLLMAgent`        | AI Agent         | An agent registered on the gateway, or one named by a virtual key's `agent_id`.                                  |
| `LiteLLMModel`        | AI Model         | A model route the gateway exposes, and the upstream provider it forwards to.                                     |
| `LiteLLMMCPServer`    | AI Tool          | An MCP server the gateway exposes to callers.                                                                    |
| `LiteLLMVirtualKey`   | Credential (NHI) | A gateway API key, surfaced as a non-human identity. Carries budget, rate limits, and rotation and expiry state. |
| `LiteLLMUser`         | User             | An internal gateway user, with a platform-wide role.                                                             |
| `LiteLLMTeam`         | Resource         | A group of users sharing a model allow-list, budget, and rate limits.                                            |
| `LiteLLMOrganization` | Resource         | A top-level grouping of teams and users.                                                                         |
| `LiteLLMAccount`      | Resource         | The gateway itself, and the resource platform-wide roles act on.                                                 |
| `LiteLLMRole`         | Resource         | A built-in LiteLLM RBAC role, surfaced as an entitlement.                                                        |
| `LiteLLMAccessGroup`  | Resource         | A named bundle of model, MCP server, and agent grants assigned to teams and keys.                                |

**Permissions model:** A virtual key is the principal that calls the gateway. Keys, teams, and users each carry a model allow-list, which Veza resolves into `USE_MODEL` privileges on the routes that principal can reach — a key with no list of its own inherits its team's. Access groups bundle `USE_MODEL`, `USE_MCP_SERVER`, and `USE_AGENT` grants and are held by teams and keys, so their grants compose into those principals' effective permissions. A key that names an agent links to it with `HAS_AGENT`, so you can trace which credential an agent acts through, and each built-in RBAC role attaches to the gateway, organization, or team its scope governs.

See the [LiteLLM AI Gateway integration guide](/4yItIzMvkpAvMVFAamTf/integrations/integrations/litellm.md#notes-and-supported-entities) for the full list of entity attributes, roles, and setup.

### Microsoft Copilot Studio

Veza resolves identity and authorization for Copilot Studio agents through cross-service connections. The Azure Dynamics 365 connection supplies the users, teams, and roles that own or hold access to an agent. The Azure AD connection supplies the Microsoft Entra security groups an agent is shared with.

| Entity Type                               | Classification | Description                                                                                             |
| ----------------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------- |
| `MicrosoftCopilotStudioBot`               | AI Agent       | AI-powered conversational agent stored in Dataverse as a bot entity.                                    |
| `MicrosoftCopilotStudioTopic`             | Resource       | Conversation flow or dialog within a copilot.                                                           |
| `MicrosoftCopilotStudioAction`            | AI Tool        | External integration or Power Automate flow invocation. Security-sensitive. Can call external APIs.     |
| `MicrosoftCopilotStudioKnowledgeSource`   | AI Tool        | Connected data source providing knowledge to the bot.                                                   |
| `MicrosoftCopilotStudioCustomGPT`         | AI Model       | AI-powered component with configurable model and capabilities.                                          |
| `MicrosoftCopilotStudioExternalAPI`       | AI Tool        | Third-party API connector invoked by Actions.                                                           |
| `MicrosoftCopilotStudioPowerAutomateFlow` | Resource       | Workflow automation triggered by the bot.                                                               |
| `MicrosoftCopilotStudioAIModel`           | AI Model       | LLM used by Custom GPT components (e.g., GPT-4o, Claude Sonnet).                                        |
| `MicrosoftCopilotStudioCapability`        | Resource       | Bot capabilities (e.g., Web Browsing, File Upload).                                                     |
| `MicrosoftCopilotStudioBotPermission`     | Permission     | Intermediate entity connecting a Dynamics 365 identity or a Microsoft Entra security group to an agent. |

Identity entities connected through the Azure Dynamics 365 cross-service connection: `Dynamics365User`, `Dynamics365ApplicationUser`, and `Dynamics365Team`. Agents shared with a Microsoft Entra security group also connect to `AzureADGroup` entities, through the Copilot Studio to Azure AD cross-service connection. The same Dynamics 365 cross-service connection also connects `Dynamics365SecurityRole` entities, which attach directly to the agent rather than through a permission entity. See **Security roles** below.

**Permissions model:** Each `MicrosoftCopilotStudioBotPermission` entity is one grant on one agent. The grantee holds a `HAS_ROLE` edge into the permission, and the permission holds an `ON_COPILOT_RESOURCE` edge to the agent it applies to. The `permission_type` property records what the grant allows, and `privileges` lists the underlying Dataverse bot privileges:

* `Owner`: The Dataverse owner of the agent record, which is a Dynamics 365 user, team, or application user. Holds full control: `READ_BOT`, `WRITE_BOT`, `CREATE_BOT`, `DELETE_BOT`, `INVOKE_BOT`, `SHARE_BOT`, and `ASSIGN_BOT`.
* `Editor`: A user or team the agent is shared with that holds both write and share rights on the record. Can edit the agent and share it with others: `READ_BOT`, `WRITE_BOT`, `SHARE_BOT`, `INVOKE_BOT`.
* `Viewer`: A user or team the agent is shared with under any other combination of rights, or a Microsoft Entra security group the agent is shared with. Can use the agent but not author it: `READ_BOT`, `INVOKE_BOT`.
* `EndUser`: Everyone in the organization, when the agent is open to all users. Carries the same use-only privileges as `Viewer`: `READ_BOT`, `INVOKE_BOT`.

Veza draws the `Editor` and `Viewer` distinction from the write and share rights on the share, not from the full Dataverse access-rights mask. A partial grant such as write without share is therefore classified as `Viewer`.

**Sharing scope:** An agent's `access_control_policy` property determines who can use the agent after it is published. Veza models both organization-level sharing choices as permissions, so a shared agent surfaces an access path from the people who can reach it:

* **Everyone in the organization** (`access_control_policy` of `0`, "Any"): Veza creates an `EndUser` permission granted to each business unit's default team. Dataverse adds every user to their own business unit's default team, so the union of those teams is every user in the organization.
* **Specific security groups** (`access_control_policy` of `2`, "Group membership"): Veza creates one `Viewer` permission for each group listed in the agent's `authorized_security_group_ids`. The permission's `azure_ad_group_id` property holds that group's Microsoft Entra object ID, and the Copilot Studio to Azure AD cross-service connection links the matching `AzureADGroup` entity to the permission with a `HAS_ROLE` edge.

Copilot Studio honors `authorized_security_group_ids` only under the group-membership policy, so Veza suppresses the value on agents that use any other policy rather than surfacing a stale group list. Agents with no access-control policy set fail closed: Veza treats a missing policy as not shared organization-wide, rather than inferring everyone-in-the-organization access. The multitenant "Any" policy (`3`) is also excluded, because it carries external-tenant semantics rather than the in-tenant share-with-everyone action.

**Security roles:** Dynamics 365 security roles that carry bot privileges (`prvReadbot`, `prvWritebot`, `prvCreatebot`, `prvDeletebot`, `prvSharebot`, `prvAssignbot`) at Global depth connect directly to every agent in the environment with an `ON_RESOURCE` edge, without an intervening permission entity. Roles holding these privileges at a narrower depth are scoped to owned or business-unit records rather than the whole environment, and are not connected.

### Microsoft 365 Copilot Agent Builder

Declarative agents published to the Microsoft 365 Copilot catalog, discovered through the Microsoft Graph Agent 365 Package Management API as part of the [Microsoft Azure integration](/4yItIzMvkpAvMVFAamTf/integrations/integrations/azure.md#enable-microsoft-365-copilot-agent-builder). This is a separate product from Microsoft Copilot Studio, discovered through a separate API.

| Entity Type                                     | Classification | Description                                                                                               |
| ----------------------------------------------- | -------------- | --------------------------------------------------------------------------------------------------------- |
| `M365AgentsDeclarativeAgent`                    | AI Agent       | A declarative agent authored in Copilot Agent Builder and published to the Microsoft 365 Copilot catalog. |
| `M365AgentsDeclarativeAgentPrivilege`           | Permission     | Intermediate node connecting an Entra user, group, or directory role to an agent.                         |
| `M365AgentsDeclarativeAgentEffectivePermission` | Permission     | Rolled-up effective permission for one principal on one agent, aggregated across all grant sources.       |

Identity nodes connected via the Azure AD cross-service connection: `AzureADUser`, `AzureADGroup`, `AzureADRole`, `AzureADTenant`.

**Properties:**

M365 Declarative Agent:

| Property                                                                                                                          | Description                                                                                                                       |
| --------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| `package_id`                                                                                                                      | Microsoft catalog package ID. Unique identifier for the agent.                                                                    |
| `display_name`                                                                                                                    | Agent name as shown in Microsoft 365 Copilot.                                                                                     |
| `owner_user_id`                                                                                                                   | Entra object ID of the agent's owner.                                                                                             |
| `available_to_scope`, `deployed_to_scope`                                                                                         | Sharing scope: `allowedForAll`, `acquiredForAll`, `specific`, `none`, or `acquiredForNone`.                                       |
| `available_to_user_ids`, `available_to_group_ids`                                                                                 | Principals permitted to install the agent, when the scope is `specific`.                                                          |
| `deployed_to_user_ids`, `deployed_to_group_ids`                                                                                   | Principals the agent is already installed for, when the scope is `specific`.                                                      |
| `is_blocked`                                                                                                                      | Whether an administrator has blocked the agent. Drives the inherited `is_active` property.                                        |
| `manifest_version`, `definition_version`                                                                                          | Agent manifest and definition versions.                                                                                           |
| `sensitivity_label_id`                                                                                                            | Microsoft Purview sensitivity label GUID, when the agent manifest carries one.                                                    |
| `sharepoint_site_ids`, `teams_team_ids`, `teams_channel_ids`, `email_mailbox_ids`, `dataverse_table_ids`, `copilot_connector_ids` | Knowledge sources the agent's manifest grounds it in.                                                                             |
| `uses_web_search`, `uses_code_interpreter`, `uses_graphic_art`, `uses_scenario_models`, `uses_people`                             | Capabilities enabled on the agent.                                                                                                |
| `embedded_file_count`, `embedded_file_names`                                                                                      | Files uploaded directly into the agent as embedded knowledge.                                                                     |
| `worker_agent_ids`                                                                                                                | Other agents this agent delegates work to.                                                                                        |
| `capabilities_raw`                                                                                                                | Verbatim manifest capabilities block, retained for per-binding configuration and restrictions not surfaced as indexed properties. |

Agents also carry the standard AI Agent base properties: `ai_platform` is `Microsoft 365 Copilot Agent Builder` and `ai_agent_publisher` is `Microsoft`.

**Permissions model:** Declarative agents have no Entra service principal of their own, so Veza models access *to* each agent rather than access *from* it. Privilege nodes are built from two independent grant sources and rolled up per principal and agent. Manifest sharing yields **Owner** (full read, write, create, delete, invoke, share, and assign), **AvailableTo** (read only, shared but not yet installed), and **DeployedTo** (read and invoke, installed and usable). Entra directory roles yield tenant-wide governance grants: **Global Administrator** and **AI Administrator** get read, delete, assign, and block; **AI Reader** gets read. Directory roles do not confer invoke, since using an agent is governed by its own sharing configuration rather than by an admin role.

**Knowledge-source relationships:** When SharePoint, Microsoft Teams, or Exchange Online are also enabled on the same Azure integration, Veza links each agent to the sites, teams, channels, and mailboxes its manifest grounds it in. These edges are non-transitive. They record what the agent is configured to read, not access the agent inherits. Agents are also linked to their Microsoft Purview sensitivity label when one is applied.

See [AI Agent Security: Microsoft 365 Copilot Agent Builder](/4yItIzMvkpAvMVFAamTf/features/ai-agent-security/configuration.md#microsoft-365-copilot-agent-builder) for setup instructions.

### Public MCP Registry

Veza discovers publicly available MCP (Model Context Protocol) servers and their tools from the public MCP registry. MCP servers connect to AI agents via cross-service connections (e.g., Microsoft Copilot Studio bots can invoke public MCP servers).

| Entity Type               | Classification | Description                                                                                         |
| ------------------------- | -------------- | --------------------------------------------------------------------------------------------------- |
| `PublicMCPRegistryServer` | AI Tool        | A publicly available MCP server from the public registry. Provides tools that AI agents can invoke. |
| `PublicMCPRegistryTool`   | AI Tool        | An individual tool exposed by a public MCP server, with defined input/output schemas.               |

### Salesforce (Agentforce)

Salesforce AI Agents are extracted from the Salesforce IAM integration. Each bot is represented as a `SalesforceBotDefinition` entity.

| Entity Type               | Classification | Description                                                                                                                            |
| ------------------------- | -------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| `SalesforceBotDefinition` | AI Agent       | An AI agent or bot defined in Salesforce (Agentforce / Einstein Bot). The `bot_definition_type` property distinguishes agent subtypes. |

**Permissions model:** Bots participate in Salesforce's standard IAM model (Profiles, Permission Sets, etc.) and inherit access to Salesforce objects through their associated user or profile.

### ServiceNow

Veza discovers AI Agents and related assets configured in ServiceNow's AI Agent Studio and Now Assist platform. ServiceNow AI Agent discovery is part of the [ServiceNow integration](/4yItIzMvkpAvMVFAamTf/integrations/integrations/servicenow.md).

| Entity Type             | Classification | Description                                                                                          |
| ----------------------- | -------------- | ---------------------------------------------------------------------------------------------------- |
| `ServiceNowAIAgent`     | AI Agent       | An AI agent defined in ServiceNow AI Agent Studio. Requires the `sn_aia` plugin.                     |
| `ServiceNowAIAgentTool` | AI Tool        | A tool or capability available to AI agents. Requires the `sn_aia` plugin.                           |
| `ServiceNowGenAISkill`  | AI Tool        | A Gen AI Skill from the Now Assist Skill Kit.                                                        |
| `ServiceNowAIModel`     | AI Model       | A generative AI model configuration. Tracks the model provider (e.g., Azure OpenAI, Amazon Bedrock). |
| `ServiceNowGenAIConfig` | Resource       | A platform-level generative AI configuration that binds capabilities to models.                      |

**Properties:**

ServiceNow AI Agent:

| Property      | Description                                                                    |
| ------------- | ------------------------------------------------------------------------------ |
| `description` | Agent description                                                              |
| `run_as_mode` | Identity mode: `ai_user` (fixed user) or `dynamic_user` (caller's permissions) |
| `is_active`   | Whether the agent is active                                                    |
| `created_at`  | When the agent was created                                                     |

ServiceNow AI Agent Tool:

| Property      | Description                |
| ------------- | -------------------------- |
| `description` | Tool description           |
| `tool_type`   | The type of tool           |
| `is_active`   | Whether the tool is active |

ServiceNow AI Model:

| Property          | Description                                        |
| ----------------- | -------------------------------------------------- |
| `model_type`      | Type of model                                      |
| `max_tokens`      | Maximum token limit                                |
| `lifecycle_state` | Model lifecycle state                              |
| `model_provider`  | Provider name (e.g., Azure OpenAI, Amazon Bedrock) |
| `is_active`       | Whether the model is active                        |

**Permissions model:** AI Agents can assume a ServiceNow user identity for resource access. When `run_as_mode` is `ai_user`, Veza creates an `ASSUMES_USER` edge from the agent to the configured ServiceNow user, enabling you to trace the agent's effective permissions through that user's roles and ACLs. ServiceNow ACL rules with types `gen_ai_agent` or `gen_ai_skill` are attached to the relevant AI entities.

See the [ServiceNow integration guide](/4yItIzMvkpAvMVFAamTf/integrations/integrations/servicenow.md) for the full list of entity attributes and required permissions.

### Workday

Veza discovers AI agents and their skills and tools from Workday's Agent System of Record (ASOR). Workday AI Agent discovery is part of the [Workday integration](/4yItIzMvkpAvMVFAamTf/integrations/integrations/workday.md) and requires Veza v2026.6.1 or later.

| Entity Type         | Classification | Description                                                                                                 |
| ------------------- | -------------- | ----------------------------------------------------------------------------------------------------------- |
| `WorkdayAIAgent`    | AI Agent       | An AI agent registered in Workday's ASOR, including Workday-built, partner-built, and self-built agents.    |
| `WorkdayAgentSkill` | AI Tool        | A task or capability an agent can perform, from the agent definition catalog and per-tenant registration.   |
| `WorkdayMCPTool`    | AI Tool        | A Workday API or task exposed to agents through Model Context Protocol, gated by a Workday security policy. |

**Permissions model:** Each Workday AI agent runs as an Agent System User (ASU) account. Veza creates an `ASSUMES_USER` edge from the agent to its ASU account (matched on the `agent_definition_workday_id` property), so you can trace the agent's effective permissions through that account's Workday security groups and policies. Each MCP tool is gated by a Workday domain or business process security policy; when the Workday IAM data source is enabled, Veza creates an `ON_RESOURCE` edge from the securing policy to the MCP tool.

See the [Workday integration guide](/4yItIzMvkpAvMVFAamTf/integrations/integrations/workday.md#agent-entities) for the full list of entity attributes and required permissions.

## Access Paths and Relationships

### How Veza Models Agent Access

Veza automatically resolves relationships between AI Agents and the identities and resources they connect to. You don't need to configure these connections — Veza builds them from the integration data it collects. View access paths in the Veza Graph UI or see the [Access path analysis](/4yItIzMvkpAvMVFAamTf/features/ai-agent-security.md#access-path-analysis) section for detailed examples.

Key relationships Veza constructs:

* **Agent → IAM Role** — For AWS Bedrock agents, Veza links the agent to its execution IAM role (`CAN_ASSUME_ROLE`), then traces that role's effective permissions across AWS services.
* **Agent → Service Account** — For Google Cloud Vertex AI Reasoning Engines, Veza links the agent to its Google Cloud service account (`USES_SERVICE_ACCOUNT`) and resolves the access granted to that service account as the agent's ambient permissions. This edge is transitive, so the agent inherits the service account's downstream access.
* **Agent → Agent Identity** — For Azure AI Foundry agents, Veza links the agent to the Microsoft Entra agent identity it runs as (`ASSUMES_USER`), then traces that identity's Azure RBAC assignments across downstream resources. Agents that predate Entra Agent ID link to their project's managed identity instead.
* **Agent → Agent Identity Blueprint** — For Azure AI Foundry agents, Veza links the agent to the blueprint governing its agent identity (`HAS_AGENT_BLUEPRINT`). This edge establishes governance lineage rather than an access path, so it appears only in the system permissions view.
* **Agent → Foundation Model** — Veza links agents to the foundation models they invoke (`HAS_FOUNDATION_MODEL`), enabling queries like "which agents use deprecated models" or "show all agents using Claude."
* **Agent → Custom or Imported Model** — Same as above for non-foundation models (`HAS_MODEL`).

### Common Access Patterns

Each hop in an agent's access path can be a security boundary. Veza makes these multi-hop paths visible so you can evaluate the full blast radius of a given agent, including every resource it can reach through its identity chain.

| Pattern                                  | Description                                                                                         | Security considerations                                                                              |
| ---------------------------------------- | --------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
| **Agent → IAM Role → S3**                | Agent reads documents from S3 directly or as a Knowledge Base data source                           | Review bucket contents for PII; verify the role grants read-only access                              |
| **Agent → IAM Role → RDS**               | Agent queries a database for real-time data using its execution role                                | High-risk: direct database access with potential write operations; confirm least-privilege           |
| **Agent → Knowledge Base → Data Source** | Agent retrieves knowledge through a pre-indexed Knowledge Base rather than raw storage              | Lower risk than direct S3 access. Data is curated at index time, but source permissions still apply. |
| **Agent → Action Group → Lambda → API**  | Agent executes business logic through a Lambda function, which may call downstream APIs or services | Review the Lambda execution role and all downstream service permissions it can reach                 |

## Next Steps

* [**AI Agent Security Overview**](/4yItIzMvkpAvMVFAamTf/features/ai-agent-security.md) - Understand AI Agent Security and key capabilities
* [**Configuration Guide**](/4yItIzMvkpAvMVFAamTf/features/ai-agent-security/configuration.md) - Set up AWS Bedrock, Google Cloud Vertex AI, or Microsoft Copilot Studio integrations
* [**Query Builder**](/4yItIzMvkpAvMVFAamTf/features/search/query-builder.md) - Build custom queries to search for AI resources
* [**Access Reviews**](/4yItIzMvkpAvMVFAamTf/features/access-reviews.md) - Create recurring reviews for AI Agent permissions
* [**Rules and Alerts**](/4yItIzMvkpAvMVFAamTf/features/insights/rules-and-alerts.md) - Configure automated alerts for AI security events


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.veza.com/4yItIzMvkpAvMVFAamTf/features/ai-agent-security/supported-entities.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.