Nervora: Governed Tool Execution for Enterprise AI Agents

Context

Nervora is Inovativi's flagship reference architecture for secure enterprise AI tool execution. It demonstrates how AI agents can interact with business systems through a controlled MCP gateway rather than direct, uncontrolled API access. The system includes OIDC authentication, tool-level RBAC, PII redaction, dry-run handling for sensitive write actions, async job execution, idempotency, structured audit logs, and OpenTelemetry tracing.

Problem

Most enterprise AI pilots fail when they move from chat interfaces to real business systems. The hard part is not generating text; it is giving agents safe, auditable, policy-controlled access to tools, data, workflows, and legacy systems. Enterprises need to know who called what, which role allowed it, what data was exposed, whether the action was read-only or destructive, and whether failures can be retried without accidental duplicate execution.

What was built / modernized

Nervora acts as a governed execution layer between AI agents and enterprise systems. Instead of allowing agents to call backend systems directly, all tool calls pass through a policy-aware MCP gateway. The gateway validates identity, checks tool-level permissions, redacts sensitive data, logs every decision, routes long-running tasks through an async worker path, and blocks destructive actions unless they are explicitly approved or run in dry-run mode.

Security flow

• OIDC / Azure Entra ID-ready authentication for every caller
• Tool-level RBAC matrix enforced at the gateway
• Sensitive HR tools available only to HR/Admin roles
• Sales agents blocked from HR data
• PII fields redacted before model-visible output
• Destructive CRM updates disabled by default
• CRM changes created as dry-run proposals requiring human approval
• Denied calls are logged, not silently ignored

Tool-calling controls

• Tool registry with explicit policy metadata — no hidden tools
• Tool policies classify read, write, destructive, sync, async, and PII-sensitive operations
• Idempotency keys for safe retries on external actions
• Async-only execution for long-running jobs
• Dry-run proposals before any destructive write executes
• Dead-letter queue and retry design for failed jobs

Observability

• Structured audit records for every tool call
• Shared trace IDs across gateway, worker, and audit records
• OpenTelemetry spans for auth, RBAC, redaction, queueing, worker execution, and audit writes
• Clear error states for denied, dry-run, queued, executed, and failed actions

Databricks & data workflow integration

• Databricks Workflow / SQL Warehouse connector abstraction
• Async execution path through an Azure Service Bus abstraction
• Worker service for long-running workflows
• Job status tracking instead of synchronous blocking
• Idempotent re-submission returns the original job ID

Workflow highlights

• FastAPI-based MCP gateway with a typed tool interface
• Tool registry with explicit policy metadata
• OIDC / Azure Entra ID-ready authentication layer
• Tool-level RBAC matrix
• PostgreSQL audit trail
• PII redaction boundary
• Async execution path through an Azure Service Bus abstraction
• Databricks Workflow / SQL Warehouse connector abstraction
• Idempotency keys, dead-letter queue, and retry design
• OpenTelemetry tracing across the call path

Security, auditability & governance

• Agents cannot bypass tool permissions
• Sensitive HR tools are only available to HR/Admin roles
• PII fields are redacted before model-visible output
• Destructive CRM execution is disabled by default and gated behind dry-run approval
• Denied calls are logged, not silently ignored
• Tool policies classify read, write, destructive, sync, async, and PII-sensitive operations

Value delivered

• Demonstrates the governance and audit controls required before agents touch sensitive systems
• Shows destructive actions gated behind dry-run approval rather than direct execution
• Proves async, idempotent execution so retries never duplicate business actions
• Provides a concrete, inspectable pattern for moving enterprise AI from pilot to controlled execution

Technologies

Relevant roles