Identity
OIDC / Google Workspace / Microsoft Entra ID
Users, groups, and roles are inherited from enterprise identity.
Customer
01 / Technical Stack
Maintain identity, catalog metadata, and data storage within your enterprise perimeter.
KunimiAI integrates with your existing data platform, decoupling identity, Apache Polaris catalog, Apache Iceberg tables, semantic models, and compute to maintain clear architecture boundaries.
02 / Stack Map
The role and technology of each layer.
LayerTechnologyRoleBoundary
Catalog
Apache Polaris
Namespaces, table visibility, and grants are handled as the catalog of record.
Customer or hosted
Storage / Table
S3 / GCS / Azure Blob + Apache Iceberg
Snapshots, schema evolution, time travel, and read / write isolation stay in open table format.
Customer
Semantics
dbt assets / ontology / metrics / policies
Queries are mapped to defined metrics and semantic models prior to execution.
Shared
Compute
Trino / Spark / Python runtime
Existing query engines and Python execution stay tied to catalog grants and snapshots.
Customer or KunimiAI
Agent runtime
KunimiAI Data Agent
Inquiries are tracked alongside generated code, execution logs, review states, and version history.
KunimiAI
Publishing
API / MCP / BI / Excel / Airflow / Dagster
Verified artifacts are published to existing work surfaces with fixed versions.
Shared
03 / Execution Control
Pre-execution authorization and policy validation.
Pre-flight authorization
User identity, group, Polaris grants, and policy are checked before compute. Unreadable tables and metrics are denied before execution.
Bounded execution
Generated SQL, Python, and workflow logic are fixed to source snapshots, semantic assets, and executing user ID.
Human review
The answer, generated code, source data, approval state, and rerun conditions are reviewed together.
Audit and lineage
Authentication, permission updates, agent interactions, table writes, and API requests generate audit logs, tracking lineage directly within each versioned commit.
04 / Interfaces
Artifacts are published where teams already work.
- APIVersioned HTTPDatasets, functions, and workflows are exposed as stable endpoints.
- MCPModel Context ProtocolClaude, Cursor, or internal copilots call typed, authorized tools.
- BIIceberg via Trino / SparkExisting BI reads Iceberg tables directly, while KunimiAI commits pin catalog references.
- OpsAirflow / Dagster / IDESchedulers and development environments can trigger workflows and read or write commits.
05 / Boundary
Deployment and operational boundaries tailored to your architecture.
- EvaluationStarter evaluates one workload with hosted catalog, hosted storage, and shared runtime.
- Production storageBring-your-own storage (S3, GCS, or Azure Blob) is the intended production model. Supported configurations and data location are confirmed during evaluation.
- CatalogHosted and bring-your-own Polaris options are evaluated during contracting, including who manages permissions and namespaces.
- Commercial boundarySemantia is the OSS core of KunimiAI. Commercial integrations, managed operation, and enterprise support are agreed by edition and contract; verify the available scope during evaluation.
06 / Next Step