Zengentic™

Zengentic™ platform

An enterprise application platform built for AI agents. Business operations are APIs and agent tools from the first day. Every agent works inside the same security, segregation of duties and audit trail as the people it works for.

Read about governance

One surface, three doors, one permission check.

The same operations are reachable from the web application, the REST API and MCP. All three pass one permission check. An AI assistant sees exactly what the person it acts for may see, and never more.

Zengentic platform architecturePeople, services and AI assistants reach one API. Microsoft Entra ID validates each token. The API applies one permission check, then the application layer runs business rules, extensions and the core, and writes append-only data to SQL Server. Secrets come from Azure Key Vault.Microsoft Entra IDor Windows Active Directorysign-invalidates every tokenPeopleBrowser, single sign-onServices and scriptsScheduled jobs, integrationsAI assistantsFor example Claude DesktopAct for a named personZengentic platformWeb applicationScreens from configurationMCP hostCarries the person'scredential, no data accessHTTPS and API keyMCPAPISingle entry pointOne permissioncheckPerson and agent:only what both holdRefusals returnedin wordsApplicationBusiness rules, lifecycles, approvals,documents, scheduler, auditExtensionsC# and PythonFenced and timedDraft, then activateCoreVersionedinterfaceUpgrade-checkedDataAppend-only records, every version keptAzure Key VaultSecrets, read at useSQL ServerYour databaseOn-premises or cloudThe application cannotchange structure, rewritehistory or delete evidence

Security layer

Every channel enters through the API: Entra token, Windows sign-in or API key. The MCP host holds no database access; it passes the person's own sign-in to the API together with the agent's identity.

One application layer

One permission check serves the screens, the API and the agent tools alike. Records are append-only.

Extensibility

Configuration first: screens, fields and rules. Then governed code in C# or Python, through a versioned interface that each release re-checks.

Built for APIs and AI agents first.

  • MCP built in

    Business operations are agent tools, each with a description a person can edit in plain words.

  • Agents act for someone

    Every request carries the person it is for and the one at the controls: a person, a service or an agent.

  • Refusals in words

    "This needs the Invoice Issue permission." The agent can tell the person why, rather than guess or retry.

  • Agents that build, people that approve

    An agent can draft a column, a custom object, a validation rule or a price curve, and check that it works. A person switches it on.

  • A catalogue of logic

    Every business operation is described in a catalogue that people maintain and agents read. Agents work from your vocabulary.

  • Hybrid by design

    On-premises on Windows Server, in the cloud, or both. SQL Server. Settings stay on the server.

Customise without changing the core.

Your behaviour lives beside the core, not inside it. So you keep upgrading.

Configuration, no code

  • Screens as configuration

    Lists, forms, columns, filters and labels, arranged on screen by administrators.

  • Your own fields and objects

    Custom fields on any record and custom objects with relationships. No database change.

  • Rules as data

    Lifecycles, approval steps, document triggers and validation rules, designed on screen.

  • Documents from templates

    HTML templates with merge fields, previewed live and printed to PDF.

Governed code, in C# or Python

  • Declared extension points

    Validate an entry, derive a value, react to a step, connect a feed, calculate a curve, run a task.

  • Contained

    Extensions use a published, versioned interface. C# extensions are fenced and time-limited. Python extensions run as a separate process under an account you control.

  • Checked before every upgrade

    Extensions are checked for compatibility with a new release before it is installed.

  • Portable

    Configuration and extensions move from development to test to production as packages.

Identity, secrets and scheduled work.

  • Microsoft Entra ID

    Single sign-on. Directory groups map to platform roles. No second user list.

  • Windows Active Directory

    Integrated sign-in for on-premises users and scripts.

  • API keys for services

    Stored only as secure hashes. Revocable at any time.

  • Azure Key Vault

    Credentials, model keys and feed tokens are read from the vault when used. A rotated key works on the next call.

  • Market data connectors

    Connectors for leading market data providers, from files or APIs. Every publication kept, corrections versioned.

  • Task scheduler

    Feeds, calculations and month-end work. Each task runs as its owner, with its own time zone and holiday calendar.

  • Command line

    A command line interface (CLI) for administrators and scripts: deploy packages, run tasks and check an environment, without opening the screens.

  • Roles from groups

    Permissions are granted to roles. Roles come from directory groups, so joiners and leavers are handled in your directory, not in the application. On non-production servers, user impersonation is available to aid support and security testing.

See an AI agent work under your controls.

In 30 minutes we show an AI assistant booking work in a live application, a person approving it, and the full record of both. Bring a real process.

Request a demoSee consulting services