Connectors

Production-grade integrations that enrich every agent intent with real-world context before governance evaluation.

Stage 2 of the governance pipeline — Context Enrichment — pulls live signals from the systems your agents actually operate in. Each connector implements the ResilientConnector base with automatic retries, configurable timeouts, and a circuit breaker that gracefully degrades when a data source is unavailable.

GaaS ships with 27 production connectors spanning communications, identity, security, developer tooling, payments, IoT, agriculture, fleet management, and multi-agent networks. Connectors run in parallel — enrichment adds minimal latency while maximising context fidelity.

Configuration: Set GAAS_CONNECTOR_CONFIG to a YAML or JSON config file path, and GAAS_CONNECTOR_MODE to production, mock, or mixed. Mock connectors are used automatically in development and testing — the pipeline logic is identical in both modes.

Communications

Call and messaging metadata used to verify TCPA consent, check opt-out status, and assess communication channel risk.

Twilio

ENTITY_STATE confidence 0.88

Fetches call metadata from your Twilio account for communication governance.

Call status, duration, direction, and recording state
Caller and recipient phone numbers
Call pricing and billing data
Used by: TCPA policy group (pol_tcpa_consent_001 and related TCPA policies)

CRM

Customer relationship data to verify account status, permission sets, and relationship context for agent actions.

Salesforce

CRM confidence 0.91

Retrieves account, contact, and opportunity records along with field-level permissions.

Account and contact record data
Permission sets and sharing rules
Opportunity stage and financial exposure
Custom governance metadata fields

Payment

Payment system signals to enforce mandate validity, spending limits, and fraud detection before transactional actions proceed.

Stripe

PAYMENT confidence 0.93

Retrieves payment method status, fraud signals, customer risk scores, and transaction history.

Customer payment method and risk metadata
Stripe Radar fraud signals and rules
Subscription and charge history
Used by: PCI-DSS (pol_t2_pci_001), PSD2 SCA (pol_ap2_006), AML velocity (pol_ap2_007)

AP2 Mandate

REGULATORY confidence 0.90

Validates payment mandates and tracks cumulative agent spending for AP2 agentic payment governance.

Mandate existence, scope, and validity window
Cumulative spend tracking against mandate limits
HNP (High Net Payment) threshold verification
Merchant trust and category codes
Used by: all 7 AP2 payment policies

Identity

Identity provider data to verify authentication strength, MFA status, group memberships, and workforce credentials before granting access or executing high-risk actions.

Okta

IDENTITY confidence 0.94

Retrieves user identity, MFA enrollment, group memberships, and authentication session context from Okta.

User profile and account status (active/locked/suspended)
MFA factors enrolled and last verification timestamp
Group and role memberships
OAuth 2.0 application access grants
Recent authentication events
Used by: Identity Verification (pol_t1_003), MFA enforcement policies

Workday

ORGANIZATIONAL confidence 0.89

Retrieves workforce records, active employment status, certifications, and training history from Workday HCM.

Employee status, department, and job classification
Active certifications and expiry dates
Required training completion status
Manager reporting chain for approval routing
Used by: Clinical AI Oversight (pol_t3_001), HIPAA training requirements

Security

Security event streams used to block agent actions during active threats, policy violations, or when the acting identity appears in security alerts.

SIEM

SECURITY confidence 0.92

Queries your SIEM for active security events, alerts, and threat intelligence related to the agent's identity and target.

Active security alerts for the acting user or agent
Recent failed authentication events
Threat intelligence matches (IP, user, entity)
Supports: Splunk, IBM QRadar, Microsoft Sentinel
Used by: Unauthorized Access Prevention (pol_t1_001), Data Exfiltration Detection

Developer

Source control and developer platform signals to enforce branch protection, code review requirements, and access controls for infrastructure-touching agent actions.

GitHub

DEVELOPER confidence 0.90

Retrieves repository metadata, branch protection rules, and organization-level security posture from the GitHub API.

Repository visibility, fork status, and permissions
Branch protection rules (required reviews, status checks, signed commits)
Organization 2FA enforcement status
Recent commit and deployment activity
Rate limit handling: 5,000 req/hr with automatic backoff

Organizational

Workplace platform data for communication channel controls, team membership verification, and SLA-aware support routing.

Slack

ORGANIZATIONAL confidence 0.89

Retrieves workspace security settings, user account status, team memberships, and channel access permissions from Slack.

Workspace-level 2FA and SSO enforcement status
User admin status and account state
Team memberships and channel access
Direct message and channel communication logs (metadata only)
Used by: Multi-Tenant Data Isolation (pol_t3_003), communication audit policies

Zendesk

ORGANIZATIONAL confidence 0.86

Fetches support ticket context, SLA breach status, and requester information to inform agent escalation decisions.

Ticket priority, status, and SLA compliance
Requester tier and previous interaction history
Breach alerts and escalation flags
Used by: customer-facing agent routing and priority policies

Operations

Observability platform data to block agent actions when production systems are degraded, SLO error budgets are exhausted, or active incidents are in progress.

Datadog

OPERATIONS confidence 0.92

Queries SLO error budgets, monitor states, and active incidents to assess production health before agent actions proceed.

SLO status and remaining error budget
Active monitor alerts and severity
Incident status (P1/P2 active incidents)
Service dependency health checks
Used by: Transaction Approval Limits (pol_t3_002), high-stakes CONTROL actions

Agent-to-Agent

Trust and reputation signals for multi-agent systems. When one AI agent delegates to another, GaaS verifies the trust chain before allowing the delegated action to proceed.

A2A Registry

IDENTITY confidence 0.85

Queries the Agent Trust Registry to look up agent identity, trust score, and interaction history.

Agent trust score (0.0–1.0) and identity verification status
Agent registration status (registered, suspended, etc.)
Interaction count from historical A2A exchanges
Agent name, URL, and registration timestamp
Used by: Multi-Agent Coordination (pol_t4_004), A2A governance proxy

Environmental & IoT

Smart home, energy, and environmental monitoring connectors for IoT-driven governance scenarios.

SmartThings

ENVIRONMENTAL configurable

Fetches device inventories and location data from Samsung SmartThings via OAuth2.

Device list with capabilities (switch, temperature, motion, contact, lock)
Location and room data
Device status polling (caps at 10 devices per fetch)
Data keys: smartthings_devices, smartthings_locations

Honeywell Home

ENVIRONMENTAL configurable

Thermostat and location data from Honeywell Home via OAuth2 + API key query parameter.

Thermostat telemetry: indoor/outdoor temp, humidity, mode, setpoints
Offline device detection — adds DEVICE_OFFLINE to data_quality_flags
Auth: Requires both OAuth2 Bearer token and apikey query param
Rate limit: 100 requests/hour per user — cache aggressively
Data keys: honeywell_thermostats, honeywell_locations

Philips Hue

ENVIRONMENTAL configurable

Lighting, rooms, and scenes from the Philips Hue cloud API (CLIP v2) via OAuth2.

Light status (on/off, brightness, color temperature), rooms, and scenes
Cloud API requires /route/clip/v2/resource/ prefix — omitting /route returns 404
Uses CLIP v2 exclusively (v1 API is deprecated)
Data keys use hue_ prefix (not philips_hue_)
Data keys: hue_lights, hue_rooms, hue_scenes

SolarEdge

ENVIRONMENTAL configurable

Solar energy monitoring and battery storage data via API key authentication.

Current power (W), daily/monthly/lifetime energy (Wh), battery telemetry
Auth: API key as api_key query parameter (not OAuth2, not header)
Rate limit: 300 requests/day per account (not per site)
Timestamps in site-local time (not UTC). Pre-configured site_ids
Data keys: solaredge_current_power_w, solaredge_today_energy_wh, solaredge_batteries

Alexa

ENVIRONMENTAL configurable

Amazon Alexa smart home device data via OAuth2.

Google Nest

ENVIRONMENTAL configurable

Google Nest thermostat, camera, and doorbell device data via OAuth2.

Ring

ENVIRONMENTAL configurable

Ring security cameras and doorbells device data via OAuth2.

Fleet & Agriculture

Heavy equipment telematics, vehicle fleet management, and agricultural data connectors.

AEMP 2.0

ENTITY_STATE confidence 0.75

ISO 15143-3 multi-OEM heavy equipment telematics. Works with Caterpillar VisionLink, Komatsu KOMTRAX, Volvo ActiveCare, JCB LiveLink, and 15+ other OEMs.

Equipment inventory: make, model, serial, status, operating hours, fuel usage
Active fault codes with severity
GPS location with timestamp
Returns XML (ISO 15143-3 standard), not JSON
Data quality: Always flags hour_meter_api_ui_discrepancy_documented — API hour meter values can differ from OEM portal UI by up to 4.6x
Auth: OAuth2 (client credentials). Config takes OEM-specific api_base_url + token_url
Data keys: aemp_equipment, aemp_active_fault_codes

Leaf Agriculture

ENTITY_STATE configurable

Unified agricultural data from multiple OEMs (John Deere, AGCO, CNH, Climate) via Leaf Agriculture’s abstraction layer.

Equipment inventory, field boundaries (with acreage), and field operations
Data keys use ag_ prefix (not leaf_) — OEM-neutral naming for future direct OEM migration
Auth: Bearer token (API key). Caps: 50 equipment, 20 operations per fetch
Data keys: ag_equipment, ag_field_boundaries, ag_operations

Tesla Fleet

ENTITY_STATE configurable

Tesla vehicle fleet telemetry and status data via OAuth2.

Additional Organizational

Project management, team collaboration, and education platform connectors.

Google Workspace

ORGANIZATIONAL configurable

Google Workspace user, group, and organizational unit data via OAuth2.

Microsoft Teams

ORGANIZATIONAL configurable

Teams, channels, and membership data from Microsoft Graph API via OAuth2.

Jira

ORGANIZATIONAL configurable

Atlassian Jira project, issue, and sprint data via OAuth2 or API key.

Asana

ORGANIZATIONAL configurable

Asana project, task, and team data via OAuth2.

Canvas LMS

ORGANIZATIONAL configurable

Canvas Learning Management System course, enrollment, and assignment data via OAuth2.

Clever

ORGANIZATIONAL configurable

Clever education platform student, teacher, and school data via OAuth2.

Additional Operations & Security

Incident management, shipping, compliance posture, and logistics connectors.

PagerDuty

OPERATIONS configurable

PagerDuty incident, on-call schedule, and service data via API key.

ShipStation

OPERATIONS configurable

ShipStation shipping, order fulfillment, and carrier data via API key.

Vanta

SECURITY configurable

Vanta compliance posture, security controls, and vulnerability data via OAuth2.

Custom HTTP

Generic connector for integrating any HTTP API as a context source.

HttpConnector

CONFIGURABLE configurable

Generic HTTP connector for integrating custom data sources. Configure the endpoint, auth method, and response mapping to pull context from any REST API into the governance pipeline.

Resilience Model

All production connectors share a common resilience pattern via the ResilientConnector base class:

Retry: Up to 3 attempts with exponential backoff on transient failures (5xx, timeouts)
Timeout: Configurable per-connector (default 5s). Prevents slow upstream from blocking the pipeline
Circuit breaker: Opens after consecutive failures; enters HALF-OPEN after a cooldown period. Failed connectors return cached or empty context — governance continues rather than halting
Error classification: HTTP 4xx errors (auth failure, not found) are returned as structured ConnectorResult with status: FAILED; network/timeout errors trigger the retry and circuit-breaker path

# Example connector configuration (GAAS_CONNECTOR_CONFIG)
connectors:
  okta:
    domain: your-org.okta.com
    client_id: ${OKTA_CLIENT_ID}
    client_secret: ${OKTA_CLIENT_SECRET}
    timeout_seconds: 5
    max_retries: 3

  siem:
    provider: splunk          # splunk | qradar | sentinel
    host: splunk.internal.example.com
    port: 8089
    token: ${SPLUNK_TOKEN}
    timeout_seconds: 8

  github:
    token: ${GITHUB_TOKEN}   # Personal access token or GitHub App
    org: your-org

Intent Declaration API — How enriched context flows into governance decisions
Policy Library — Policies that consume connector data
A2A & Agent Networks — Agent trust registry and multi-agent governance
Shadow Mode — Test connectors against live traffic without enforcement

Connectors

Communications

Twilio

CRM

Salesforce

Payment

Stripe

AP2 Mandate

Identity

Okta

Workday

Security

SIEM

Developer

GitHub

Organizational

Slack

Zendesk

Operations

Datadog

Agent-to-Agent

A2A Registry

Environmental & IoT

SmartThings

Honeywell Home

Philips Hue

SolarEdge

Alexa

Google Nest

Ring

Fleet & Agriculture

AEMP 2.0

Leaf Agriculture

Tesla Fleet

Additional Organizational

Google Workspace

Microsoft Teams

Jira

Asana

Canvas LMS

Clever

Additional Operations & Security

PagerDuty

ShipStation

Vanta

Custom HTTP

HttpConnector

Resilience Model

Related Pages