Connection authentication

DataQI integrates with your enterprise environment using two distinct authentication models, depending on the type of connection being made: user-scoped connections and globally configured connections.

Globally configured connections

Connections to external business systems are handled via the Model Context Protocol (MCP). These connections are configured globally at the environment level.

When an agent interacts with an MCP tool, it authenticates using a dedicated service account or API key rather than your personal identity. For more details on how this impacts tool execution, see Security boundaries.

User-scoped connections

By contrast, when DataQI connects to your enterprise file systems (e.g., Windows File Shares), it uses a User Identity Delegation (UID) model. This ensures that DataQI only ever accesses documents on your behalf, strictly respecting your existing enterprise permissions.

When you interact with an agent that searches a Windows File Share, that agent does not use a global “super admin” service account. Instead, the agent delegates your personal identity to the file share.

If you cannot naturally see a file or folder in Windows Explorer, DataQI cannot see it either. This ensures that DataQI does not promote data beyond the permissions you have already been granted in your enterprise environment.

Authentication vs authorisation

DataQI differentiates between proving who you are and permitting access:

1. Authentication (Identity): Proving your identity is handled automatically by your organisation’s Single Sign-On (SSO) when you log into DataQI.
2. Authorisation (Consent): Explicitly permitting DataQI to use those credentials to access a specific data route on your behalf.

Deferring authentication

When you log into DataQI, you may be prompted if new data sources require your authorization. To ensure a zero-friction experience:

• You can choose to “Auth Later” or simply dismiss the prompt.
• Deferring authentication will not block you from using the rest of the DataQI platform.
• However, if you attempt to use an agent that requires a deferred data source, that agent’s capabilities will be degraded until you authenticate the connection.

You can manage your active connections and re-authenticate at any time from your user profile settings.

Relational database credentials

DataQI uses the database credentials configured for a relational connection when the SQL query capability executes a query. The database account’s permissions are therefore the primary security boundary.

Before making a relational connection available, a database administrator must configure a dedicated, least-privileged account with read access limited to the required data. Do not provide owner, administrative, superuser or data-modification permissions.