Role Assistants request governed business capabilities — approved business actions under Operational Trust — not unrestricted vendor APIs, agent tool lists, or application credentials.
AI can recommend, prepare, and request work. It cannot grant itself authority.
Why it matters
Agent frameworks often give models tools and APIs directly. That breaks enterprise accountability: permissions expand silently, actions are hard to audit, and “the agent decided” is not acceptable for regulated work.
AI Fabrix exposes enterprise capability keys (for example customer.search) only after certification. Every request is checked for identity, Business Role, dimensions, policy, approval, and Evidence requirements before execution.
How it works
What this shows: ChatGPT, Copilot, or Teams can carry the conversation. They must not call enterprise APIs. The Role Assistant requests a governed capability; Operational Trust decides whether work proceeds.
What this is not: Giving an AI interface tools, API keys, or a prompt that creates permission.
A Role Assistant may understand a request, gather permitted context, draft a recommendation, and request a capability. It does not:
- invent authority beyond the active Business Role
- bypass policy or approval gates
- expand permissions when skill level increases
- execute directly against enterprise systems with embedded credentials
The Business Role is the operating boundary for what work may be requested — not the assistant persona or chat interface. Dimensions and Operational Trust bound which records may appear in that work.
The interface can change. The governed business capability remains with the enterprise.
Integrator connection
Capabilities become available to Role Assistants only after integrators:
- Model datasources with business metadata
- Expose and upload integrations
- Pass certification pillars (certification guide)
Operators do not assign capability rows to Role Assistants. The platform generates the catalog from published Business Entities; operators use Make available when a Draft assistant should enter service. Full path: How Role Assistants get capabilities. Integrators declare meaning on the Build track: Configure AI contract. Architecture detail for mediation: Capability gateway.
Limits
- Capabilities must be published (and trust-gated when deployment gates are enabled) before Role Assistants can request them in production; this page does not replace the Build → Business Entities configure track.
- Generic “agent” patterns without capability manifests are out of scope for AI Fabrix Role Assistants.
Example
A Finance Assistant recommends an approval package and requests approval.prepareRequest. The platform validates role, policy, and certification. The Assistant does not post to a finance API with embedded credentials.
Business value
Enterprise-safe execution, explainable allow/deny decisions, and a clear line between AI assistance and system mutation.