diff --git a/modules/ROOT/nav.adoc b/modules/ROOT/nav.adoc index 39ec1cab6..74537f453 100644 --- a/modules/ROOT/nav.adoc +++ b/modules/ROOT/nav.adoc @@ -28,6 +28,7 @@ *** xref:exp-scanners-view-details.adoc[] *** xref:exp-scanners-manage.adoc[] *** xref:exp-providers-manage.adoc[] + *** xref:exp-data-service-lineage.adoc[] ** xref:exp-governance-view-cost-and-token-usage.adoc[] *** xref:model-proxy-token-reports.adoc[] ** xref:exp-akamai-risk-correlation.adoc[] diff --git a/modules/ROOT/pages/exp-data-service-lineage.adoc b/modules/ROOT/pages/exp-data-service-lineage.adoc new file mode 100644 index 000000000..b1be3cdbc --- /dev/null +++ b/modules/ROOT/pages/exp-data-service-lineage.adoc @@ -0,0 +1,110 @@ += Viewing Data Service Lineage +:keywords: lineage, data service, context catalog, agent fabric, informatica, cdgc, data lineage, agent to data, impact analysis, provenance, confidence score + +Data service lineage connects your AI agents to the enterprise data services they consume, creating a navigable graph from agent to MCP server to API to dataset. Lineage is part of the Context Catalog capability in Agent Fabric, which is built on the Informatica Cloud Data Governance and Catalog (CDGC) integration. With lineage, Agent Fabric gains semantic awareness of what data an agent touches, how that data is classified, and what quality and policy constraints apply. + +You bring data services and their lineage into Agent Fabric by creating an Informatica CDGC scanner. The scanner imports the data services, and Context Catalog builds the lineage that links them to your agents. + +Use lineage to answer questions that Agent Fabric couldn't answer before, such as which datasets influence an agent's output, which agents depend on a dataset you're about to change, and whether an agent is reading data outside its declared scope. + +[NOTE] +==== +Data service lineage is part of the Context Catalog capability and is available only when your administrator has enabled the feature for your organization. + +Lineage currently supports only agents discovered from Amazon (AWS Bedrock). Agents from other providers don't yet show lineage. +==== + +== How Data Services and Lineage Get Populated + +Data services and their lineage come into Agent Fabric through the Informatica Cloud Data Governance and Catalog (CDGC) scanner: + +. You create an Informatica CDGC scanner to connect to your Informatica catalog. See xref:exp-scanners-add-from-providers.adoc[]. +. When the scanner runs, it brings in *data services*—datasets and their metadata, such as schemas, owners, classifications, quality scores, and glossary terms—from Informatica CDGC into the *Data Services* catalog (currently labeled *Data assets* in the UI). +. Context Catalog then detects lineage edges that connect those data services to the APIs, MCP servers, and agents that use them, building the agent-to-data lineage graph. + +Because lineage depends on the Informatica CDGC scanner, no lineage appears until at least one Informatica scanner has run successfully. Currently, the lineage graph is populated only for agents discovered from Amazon (AWS Bedrock). + +== Before You Begin + +Before you can view lineage, make sure that: + +* Your administrator has enabled the Context Catalog feature for your organization. +* An Informatica Cloud Data Governance and Catalog (CDGC) scanner has run so that data services, classifications, and glossary terms are ingested into the registry. See xref:exp-scanners-add-from-providers.adoc[] and xref:exp-scanners-prerequisites-reference.adoc[]. +* The agents whose lineage you want to view were discovered from Amazon (AWS Bedrock). Lineage currently isn't available for agents from other providers. + +== How Lineage Is Detected + +Context Catalog automatically detects lineage edges—connections between assets, such as an API reading from a dataset—by using scanners, runtime configuration, and traffic traces. Each detected edge carries a *confidence score* that shows how certain the system is that the connection is real, along with the source and method used to detect it. + +Lineage is classified by how it was detected: + +* *Observed* — the connection was seen in runtime configuration or traffic traces (for example, calls captured in Flex Gateway telemetry). Observed lineage carries the highest confidence. +* *Declared* — the connection was read from registration or configuration metadata, such as an Anypoint MCP Bridge configuration that maps each MCP tool to its backend API operation. +* *Inferred* — the connection was derived from partial metadata, such as mapping an agent's listed APIs or tools to the MCP servers that expose them. + +System-detected edges are a permanent record. The original detection—its confidence score, source, detection method, and timestamp—can't be edited or deleted. You can layer your own judgment on top of a detection, but the original evidence of what the system found, and why, always remains intact. + +== View Lineage for an Asset + +You view lineage from the detail page of an asset in a *Portfolio* catalog: + +. Open the catalog for the asset type you want (for example, *Agents*), then select the asset to open its detail page. +. Select the *Lineage* tab. +. Review the lineage graph. The current asset version is the *Root* node, and connected assets branch out from it. + +If no lineage has been detected yet, the tab shows *No lineage recorded for this asset version yet*. + +== Read the Lineage Graph + +The lineage graph is a topology view rooted at the current asset version. Each node represents an asset, a deployment instance, or an external data source, and each edge represents a directed relationship between two nodes. + +=== Node Types + +Nodes are grouped into lanes and labeled by type: + +* *Asset* — a registered asset, further identified by asset type: *Broker*, *Agent*, *MCP*, *LLM*, *API*, *Mule App*, or *Data set*. +* *Instance* — a deployment instance of an asset. +* *External* — an external data source that isn't registered in *Portfolio*. + +The *Root* label marks the asset version you're viewing. Nodes that aren't registered in *Portfolio* are marked *Unregistered asset* or *Not in Portfolio*. + +=== Edges and Provenance + +Each edge shows the direction of the relationship and how it was detected. The graph legend distinguishes: + +* *Observed* — detected in runtime traffic or configuration. +* *Inferred* — derived from partial or heuristic metadata. + +Edges are also labeled by when the relationship was established: + +* *Design-time (declared)* — declared in registration or configuration. +* *Runtime (observed in traces)* — observed in runtime traffic. + +For any node, the graph summarizes how many upstream and downstream relationships it has and how many connected assets exist across how many types. + +== Explore Lineage in Detail + +The *Lineage* tab includes controls for working with larger graphs: + +* *Explore lineage* — opens the *Lineage explorer* in a fullscreen view. +* *Zoom in*, *Zoom out*, and *Reset zoom* — adjust the graph scale. +* Asset-type filters — narrow the graph to specific asset types. +* Select a node to open its details, including its description, ID, and URL. When the asset is registered, select *View in Portfolio* to open its detail page. If details aren't available, the drawer shows *Details unavailable*. + +== Use Cases + +Lineage supports governance and investigation across the full stack, from agent behavior down to the datasets and fields that drive it: + +* *Answer explainability* — show which dataset, version, and path is influencing an agent's output, so responses are easier to trust and review. +* *Root-cause analysis* — when an agent gives a bad answer, trace whether the issue came from the source data, a transformation, retrieval, or the agent's prompt or tooling path. +* *Impact analysis* — before changing a dataset or schema, identify which agents, workflows, and downstream systems might break. For example, before deprecating a Snowflake table, see that a production Claims Processing Agent depends on it. +* *Governance and policy enforcement* — propagate classifications such as PII, confidential, certified, or expired through lineage, and use them to inform policy recommendations for affected agents. +* *Auditability and compliance* — keep a defensible record of what data an agent used, which is useful for regulated environments and audit reviews. +* *Data quality monitoring* — tie agent failures or low-confidence outputs back to freshness, completeness, schema drift, or quality issues in the underlying dataset. + +== See Also + +* xref:exp-scanners-add-from-providers.adoc[] +* xref:exp-scanners-prerequisites-reference.adoc[] +* xref:exp-services-view-details.adoc[] +* xref:agent-fabric-overview.adoc[] diff --git a/modules/ROOT/pages/exp-glossary.adoc b/modules/ROOT/pages/exp-glossary.adoc index e6dd52476..6a9dcb2fc 100644 --- a/modules/ROOT/pages/exp-glossary.adoc +++ b/modules/ROOT/pages/exp-glossary.adoc @@ -24,9 +24,15 @@ The embedded agentic experience built into the enhanced MuleSoft experience UI. Conformance Report:: A view on the detail pages of agents, APIs, and MCP servers that shows compliance scores, rule violations, and warnings that applied governance strategies generate. +Context Catalog:: +A capability in Agent Fabric that connects AI agents to the enterprise data services they consume, creating a navigable lineage graph from agent to MCP server to API to dataset. Context Catalog is built on the Informatica Cloud Data Governance and Catalog (CDGC) integration and gives Agent Fabric awareness of what data an agent touches, how it's classified, and what quality and policy constraints apply. Available only when your administrator enables the feature. + Cross-gateway conformance:: A unified view of compliance status across APIs hosted on Anypoint Platform gateways and connected third-party provider gateways. Access cross-gateway conformance from the *Governed Services* tab of an active governance strategy. Use the *Any provider* filter to compare conformance by platform or focus on a specific provider. +Data service:: +A dataset and its metadata ingested from Informatica Cloud Data Governance and Catalog (CDGC) into the Agent Fabric registry, normalized into a model that includes name, type, source system, owner, classifications, quality score, and glossary terms. Data services appear in the *Data Services* catalog and are the foundation for lineage in Context Catalog. + Enhanced experience:: The new MuleSoft UI for managing your AI portfolio, including governance, instance management, observability, and agentic experiences. @@ -57,6 +63,9 @@ Runtime rules that govern traffic passing through service instances. Policies co Instance:: A deployed version of a service on a specific gateway or runtime. Instances receive traffic on the Instance URL and proxy requests to the Target URL. Supported service types include APIs, agents, MCP servers, and Model proxies. +Lineage:: +A graph of directed relationships that connects an agent to the data services it consumes, spanning agent, MCP server, API, and dataset. Context Catalog detects lineage edges from scanners, runtime configuration, and traffic traces, and records each edge with a confidence score and a detection type of observed, declared, or inferred. View lineage from the *Lineage* tab on an asset detail page. Lineage currently supports only agents discovered from Amazon (AWS Bedrock). + Model Proxy:: A gateway-backed service that routes requests to a large language model. Model proxies register in the Model Proxies catalog and support instance management, policy application, and token usage monitoring. @@ -76,7 +85,7 @@ Platform MCP Server:: The MCP server that exposes enhanced MuleSoft experience capabilities to MCP clients such as Claude Desktop. Use Platform MCP Server to access portfolio and governance features from supported development environments. Portfolio:: -The set of services registered or discovered within your org, organized into catalogs for agents, APIs, MCP servers, Model proxies, and gateways. Each catalog provides governance, monitoring, and instance management for the services it contains. +The set of services registered or discovered within your org, organized into catalogs for agents, APIs, MCP servers, Model proxies, and gateways. Each catalog provides governance, monitoring, and instance management for the services it contains. When the Context Catalog feature is enabled, Portfolio also includes a Data Services catalog (currently labeled *Data assets* in the UI) for data services imported from Informatica. Providers:: The external cloud platforms connected to the enhanced experience to enable automated service discovery and import. Configure providers under *Platform* > *Providers*. diff --git a/modules/ROOT/pages/exp-home-start.adoc b/modules/ROOT/pages/exp-home-start.adoc index 45deeb6e9..ccd48f22d 100644 --- a/modules/ROOT/pages/exp-home-start.adoc +++ b/modules/ROOT/pages/exp-home-start.adoc @@ -75,7 +75,7 @@ Confirm your credentials and the permissions your administrator assigned, as des Sign in through your entry path and land on *Home*. Scan *Portfolio* catalogs, *Governance*, *Observability*, and *Platform* so you know where to register assets, apply policies, read health signals, and manage providers. . Register assets in Portfolio + -Under *Portfolio*, open *Agents*, *MCP Servers*, *Model Proxies*, *APIs*, or *Gateways*. Add assets to work with. Register manually or use connected providers under *Platform* > *Providers* if your organization enables discovery flows. +Under *Portfolio*, open *Agents*, *MCP Servers*, *Model Proxies*, *APIs*, or *Gateways*—or *Data Services* (currently labeled *Data assets* in the UI) when your administrator enables the Context Catalog feature. Add assets to work with. Register manually or use connected providers under *Platform* > *Providers* if your organization enables discovery flows. . Create and manage instances + On *Agents*, *MCP Servers*, *Model Proxies*, and *APIs*, open *Instances* to create managed or unmanaged deployments that match your needs. Managed instances on Omni Gateway give stronger governance and monitoring when the new experience exposes them. *Gateways* don't include an *Instances* tab. diff --git a/modules/ROOT/pages/exp-overview.adoc b/modules/ROOT/pages/exp-overview.adoc index a27692f30..5e248dead 100644 --- a/modules/ROOT/pages/exp-overview.adoc +++ b/modules/ROOT/pages/exp-overview.adoc @@ -9,7 +9,7 @@ Your AI services stay audit-ready with clear visibility into cost and runtime he The enhanced MuleSoft experience supports the full lifecycle of AI-connected integration services: -Entity Management:: Register and manage agents, REST and GraphQL APIs, MCP servers, Model proxies, and gateways, including Anypoint Omni Gateway, external gateways, and unmanaged gateways. Each type has a dedicated catalog under *Portfolio*. +Entity Management:: Register and manage agents, REST and GraphQL APIs, MCP servers, Model proxies, and gateways, including Anypoint Omni Gateway, external gateways, and unmanaged gateways. Each type has a dedicated catalog under *Portfolio*. When your administrator enables the Context Catalog feature, a *Data Services* catalog (currently labeled *Data assets* in the UI) also appears, holding data services imported by an Informatica scanner. Governance and Compliance:: Define and apply policies across domains such as access and security, performance and cost, data privacy and integrity, and compliance and observability. Conformance reporting summarizes rule violations and severity so you can close gaps systematically. @@ -32,7 +32,7 @@ Sign in through your entry path and land on *Home*. Scan *Portfolio* catalogs, * For AI assistant usage, see xref:exp-ai-assistant-use.adoc[]. . Register services in *Portfolio*. + -Under *Portfolio*, open *Agents*, *MCP Servers*, *Model Proxies*, *APIs*, or *Gateways*. Add services to work with. Register them manually or use connected providers under *Platform* > *Providers* if your organization enables discovery flows. For registration methods, see xref:exp-services-add-to-portfolio.adoc[]. +Under *Portfolio*, open *Agents*, *MCP Servers*, *Model Proxies*, *APIs*, or *Gateways*—or *Data Services* when Context Catalog is enabled. Add services to work with. Register them manually or use connected providers under *Platform* > *Providers* if your organization enables discovery flows. For registration methods, see xref:exp-services-add-to-portfolio.adoc[]. . Create and manage instances. + In *Portfolio*, open a service detail page from *Agents*, *MCP Servers*, *Model Proxies*, or *APIs*, then open the *Instances* tab to create managed or unmanaged deployments that match your needs. Managed instances on Omni Gateway give stronger governance and monitoring when the new experience exposes them. *Gateways* don't include an *Instances* tab on their detail page. For instance workflows, see xref:exp-instances-add.adoc[]. diff --git a/modules/ROOT/pages/exp-portfolio-overview.adoc b/modules/ROOT/pages/exp-portfolio-overview.adoc index 7b9bf2f3e..fe60172fc 100644 --- a/modules/ROOT/pages/exp-portfolio-overview.adoc +++ b/modules/ROOT/pages/exp-portfolio-overview.adoc @@ -1,7 +1,7 @@ = View Your Portfolio Overview :keywords: portfolio overview, anypoint platform, api management, integration monitoring, portfolio dashboard, mulesoft -Use portfolio-level views to see how your agents, APIs, MCP servers, Model proxies, and gateways fit together before you drill into a single service. These summaries help you spot gaps in registration, policy coverage, and health signals. +Use portfolio-level views to see how your agents, APIs, MCP servers, Model proxies, data services, and gateways fit together before you drill into a single service. These summaries help you spot gaps in registration, policy coverage, and health signals. The exact layout depends on how your administrator configured your tenant and which catalogs they enabled. include::_partials/exp-navigation-labels.adoc[tag=ExpNavigationLabels] @@ -28,7 +28,7 @@ For more information, see xref:exp-home-start.adoc#permissions[Enhanced Experien After you log in, *Home* shows an overview of services discovered, consumed, and governed, as well as a list of scanners and actions to add a service. * *Portfolio* + -Browse catalogs for *Agents*, *APIs*, *MCP Servers*, *Model Proxies*, and *Gateways* in *Portfolio*. Each catalog lists the services that your team registered or imported. To find a specific service, use search and filters, and then select the service to view its details. +Browse catalogs for *Agents*, *APIs*, *MCP Servers*, *Model Proxies*, and *Gateways* in *Portfolio*. When your administrator enables the Context Catalog feature, a *Data Services* catalog (currently labeled *Data assets* in the UI) also appears; it holds the data services imported by an Informatica scanner. Each catalog lists the services that your team registered or imported. To find a specific service, use search and filters, and then select the service to view its details. If you don't see an expected catalog or summary, confirm product access and permissions with your Anypoint Platform organization administrator. See xref:exp-home-start.adoc#permissions[Enhanced Experience Permissions] for more information. diff --git a/modules/ROOT/pages/exp-scanners-add-from-providers.adoc b/modules/ROOT/pages/exp-scanners-add-from-providers.adoc index 1fedbdaef..7c9903111 100644 --- a/modules/ROOT/pages/exp-scanners-add-from-providers.adoc +++ b/modules/ROOT/pages/exp-scanners-add-from-providers.adoc @@ -78,6 +78,21 @@ When the policy is applied, the section shows a table with one row per environme If some environments show no policy binding, select *Check again* to retry the policy application for those environments only. The operation is safe to repeat. +== Informatica Cloud Data Governance and Catalog (CDGC) Scanner + +The Informatica Cloud Data Governance and Catalog (CDGC) scanner behaves differently from service-import scanners. Instead of discovering agents, APIs, or MCP servers, it brings *data services* into the *Data Services* catalog (currently labeled *Data assets* in the UI) and gives Context Catalog the metadata it needs to build agent-to-data lineage. Create an Informatica CDGC scanner to populate data services and enable lineage for your agents. *Informatica Cloud Data Governance and Catalog* appears in the provider list only when your administrator has enabled the Context Catalog feature for your organization. + +When the scanner runs, it ingests the following from CDGC and normalizes it into a data service model: + +* Dataset names, schemas, and owners +* Classifications and regulatory tags, such as PII, PHI, confidential, GDPR, HIPAA, and PCI +* Data quality scores and freshness metrics +* Business glossary terms, classification rules, and asset-to-term associations, including the resulting field-level (column-level) PII tags + +The ingested data services and their classifications appear in the *Data Services* catalog and are the foundation for lineage. The system then detects lineage edges—connections between assets, such as an API reading from a dataset—from scanners, runtime configuration, and traffic traces, and records a confidence score for each edge. Lineage currently supports only agents discovered from Amazon (AWS Bedrock). For how to view and interpret lineage, see xref:exp-data-service-lineage.adoc[]. + +For the required Informatica credentials, account, permissions, and setup, see xref:exp-scanners-prerequisites-reference.adoc[]. + == Scanner Configuration Overview Regardless of entry point, adding a scanner establishes trust and scope. You specify which provider platform to reach, how the system authenticates, and how you validate connectivity. You also name and schedule the scanner—or configure another trigger—so discovery runs on the cadence your team expects. Saving the configuration activates the scanner for the catalogs and features your administrator enabled. @@ -94,8 +109,8 @@ For ongoing operations (pause, edit, or delete), see xref:exp-scanners-manage.ad * xref:exp-scanners-prerequisites-reference.adoc[] * xref:exp-akamai-risk-correlation.adoc[] +* xref:exp-data-service-lineage.adoc[] * xref:exp-services-connect-providers-to-add.adoc[] -* xref:exp-scanners-prerequisites-reference.adoc[] * xref:exp-scanners-manage.adoc[] * xref:exp-services-add-to-portfolio.adoc[] * xref:exp-services-view-details.adoc[] diff --git a/modules/ROOT/pages/exp-scanners-prerequisites-reference.adoc b/modules/ROOT/pages/exp-scanners-prerequisites-reference.adoc index f09f75f74..b25c49fea 100644 --- a/modules/ROOT/pages/exp-scanners-prerequisites-reference.adoc +++ b/modules/ROOT/pages/exp-scanners-prerequisites-reference.adoc @@ -214,6 +214,26 @@ a| *Role:* `ACCOUNTADMIN` +| Informatica Cloud Data Governance and Catalog (CDGC) +| Data +a| +*Credentials:* Region; Informatica username and password. The scanner uses your Informatica Intelligent Cloud Services (IICS) username and password to authenticate against the selected region's pod and exchanges them for a session token. + +*Region options:* + +* North America (NA pod) +* EMEA (EM pod) +* United Kingdom (UK pod) +* Asia Pacific & Japan (AP pod) +* Canada (NA pod) + +*Account:* Informatica Intelligent Cloud Services (IICS) account with Cloud Data Governance and Catalog (CDGC) enabled, with access to the catalog sources you want to scan + +*Setup:* At least one CDGC catalog source registered (for example, a Snowflake connection) so that datasets, classifications, glossary terms, and quality metrics are available to ingest + +[NOTE] +The Informatica CDGC scanner is part of the Context Catalog capability in Agent Fabric and is available only when your administrator has enabled the feature for your organization. + |=== == See Also diff --git a/modules/ROOT/pages/exp-services-add-to-portfolio.adoc b/modules/ROOT/pages/exp-services-add-to-portfolio.adoc index 3fea7422e..01f16fe2a 100644 --- a/modules/ROOT/pages/exp-services-add-to-portfolio.adoc +++ b/modules/ROOT/pages/exp-services-add-to-portfolio.adoc @@ -3,6 +3,8 @@ Your *Portfolio* is organized into catalogs: *Agents*, *MCP Servers*, *Model Proxies*, *APIs*, and *Gateways*. Each catalog holds the services (or gateway entries) your organization registered or imported for governance, monitoring, and deployment. Services enter a catalog through automated provider discovery or manual registration. For procedures, use the topics linked in each section. +When your administrator enables the Context Catalog feature, a *Data Services* catalog (currently labeled *Data assets* in the UI) also appears. Unlike the other catalogs, you don't register data services manually—you populate them by creating an Informatica CDGC scanner. See xref:exp-scanners-add-from-providers.adoc[] and xref:exp-data-service-lineage.adoc[]. + [cols="1,2",options="header"] |=== |Approach |What Happens