Provisa / AI access
Now leadership wants an AI agent on it, and nobody wants to hand it the database.
Point Claude or any MCP client at Provisa instead of the database. The agent acts as a role, so it reads the tables, rows and columns the role reads, and nothing else. Every question it asks is in the request record.
Connect your data, query with an AI agent, in five minutes
1. Install and start Provisa
Download the installer for your machine from the download section and run it. The first launch finishes a one-time setup with no internet needed. Then start the services and open the UI.
provisa start # every service, on your machine
provisa open # the UI, in your browser2. Connect the sources
In the UI, open Sources and add Postgres, Snowflake and Salesforce (or whichever sources the agent needs). Provisa reads each source's catalog; pick the tables to register. Nothing is copied: queries go to the data where it lives.
3. Give the agent a role
Open Security → Roles and add a role for the agent. Grant it the domains and columns it needs; mask the ones it may see only in part. A role is governed by default: it reads nothing it is not granted.
4. Point the agent at Provisa
Open Admin → MCP server for the server's address, then add it to your MCP client. In Claude Code:
claude mcp add --transport http provisa <the MCP server address>5. Ask a question
The agent lists the tables its role reads, writes SQL, and runs it through Provisa. Joins it was not given a relationship for are refused, and its results are masked as the role's are.
> Which customers with an open support case placed an order over $1,000 this month?6. Read the request record
Admin → Requests shows each query the agent ran, as which role, and the governance applied to it.
What stays true
- The agent's OAuth token maps to a role, as a person's does.
- Row rules, column grants and masks apply to every query it writes.
- Query load is bounded per role, so an agent cannot flatten a source.