Three languages. Nine protocols. One schema.

Query languages

GraphQL

Per-role schemas with field-level visibility, cursor pagination, and aggregates. The schema is constrained to registered relationships, so a query that traverses an unapproved path cannot be expressed — it is valid by construction rather than rejected at runtime. Apollo Automatic Persisted Queries are included.

SQL

Full SQL over federated data, correlated subqueries and all. Cross-source joins fan out through the federation engine; single-source queries bypass federation entirely and route direct to the driver, transactional and sub-100ms.

Cypher

Graph queries over the same federated schema. Traverse relationships as edges, union sources into a single node label, and walk variable-length paths — under identical governance to the SQL and GraphQL paths.

Wire protocols

pgwire — port 5439

Any Postgres client connects: psql, DBeaver, DataGrip, pandas read_sql, or anything else speaking the frontend/backend protocol. pg_catalog is answered in-memory, so schema browsers, foreign-key arrows, and autocomplete work without a real Postgres behind them.

Bolt (Neo4j)

Neo4j Browser, Bloom, and the official drivers run Cypher over Bolt against the federated graph. Each role surfaces as a provisa_<role> database, so the client's database picker is the governance boundary.

Arrow Flight

Arrow record batches streamed over gRPC — columnar all the way out, with no row-by-row serialization between the engine and the client. Accepts GraphQL or SQL. Result sets are unbounded: nothing is materialized server-side while the client reads.

gRPC model API

A .proto is generated from the registered schema: typed query and insert RPCs per table, with streamed responses. Regenerating is a consequence of changing the model, not a separate build step.

JDBC and REST

BI tools — Tableau, Power BI, DBeaver — connect over JDBC. Applications get JSON:API 1.1 at /data/jsonapi/{table}, with sparse fieldsets and filter expressions.

Airport (DuckDB)

Any DuckDB client attaches Provisa as a database — ATTACH 'grpc://host' AS p (TYPE AIRPORT) — and queries the governed federated schema from local DuckDB. Filters and projections push down; writes update by primary key.

WebSocket and SSE

Subscriptions stream near-real-time change events. The backend is your choice: Postgres native notification, MongoDB change streams, CDC, or polling — and events can fan out over Kafka.

For AI agents

MCP server

A Model Context Protocol server — stdio and remote Streamable HTTP — exposes your governed, federated data to agents like Claude as tools. The OAuth token maps to a role, so every agent call is governed by the same six layers as a human query. Agents get no bypass, and no separate policy to keep in sync.

Natural language

NL→SQL, Cypher, or GraphQL powered by Claude, with an interactive validation loop so a generated query is reviewed before anything executes.