Skip to main content
View as MarkdownOpen in ChatGPTOpen in Claude

AI features and data handling

Axiad Mesh includes AI-powered features that help you investigate your data and set up your tenant. This page describes where AI appears in the product, what data those features can access, how sensitive values are protected, how AI activity is audited, and which questions to raise in your organization's privacy review.

Where AI appears in Mesh​

Mesh AI assistant​

The Mesh AI assistant is available from anywhere in the dashboard through the floating action button. You can ask free-form questions about your assets, identities, and risks in plain language, or start from guided prompts such as "Show me expiring certificates." Answers are grounded in your own data — the assistant works from the same data you see in the dashboard.

Conversational tenant onboarding​

When an administrator signs in to a tenant that hasn't completed setup, Mesh opens a full-page, guided onboarding experience instead of the dashboard. The onboarding assistant walks you through capturing your organization profile, setting up your identity provider, choosing recommended connectors, and validating each configured integration.

How the flow behaves:

  • Progress is saved at the tenant level and shared across all administrators, so any administrator can resume exactly where the flow left off.
  • You can skip onboarding. If you do, you return to the flow on your next sign-in.
  • Users without administrator access go straight to the dashboard.

Guided Universal REST connector setup​

The Universal REST API connector uses a guided, conversational setup. It walks you through the application name, the base URL, the OpenAPI or Swagger specification, and the authentication scheme, then validates the specification and helps you select which data to collect.

Agent-to-agent (A2A) integrations​

Mesh supports the open A2A (Agent2Agent) protocol in both directions, so the Mesh AI assistant can participate in your broader agent ecosystem:

  • Outbound — Mesh calls your agents. Administrators can register external A2A agents with Mesh. Once registered, the Mesh AI assistant can discover and invoke them during an investigation — for example, asking a remediation agent in another system to act on a finding. Each registered agent uses the authentication your administrator configures (API key, bearer token, or OAuth 2.0), and credentials are stored encrypted.
  • Inbound — your agents call Mesh. Your organization's own AI agents can connect to the Mesh agent over A2A and ask it questions or delegate Mesh-related tasks, with the same authentication and tenant isolation as any other access to your data. Mesh publishes a standard A2A agent card describing its skills and how to authenticate — see Connect your agent to Mesh for the full integration guide.

Nothing is connected by default: both directions require explicit administrator configuration.

Data access and isolation​

The assistant only sees data your signed-in account is permitted to see, and your organization's data stays fully isolated. Answers reflect your own permissions in Mesh — the assistant doesn't grant access to anything you couldn't already view in the dashboard.

Sensitive-data protection​

Every AI request passes through Mesh's PII protection gateway before it reaches any external large language model. The gateway works in both directions:

  • On the way out, personal data in your request and in the tenant data the assistant consults — values such as names, email addresses, and account identifiers — is replaced with opaque tokens. The tokens carry no meaning outside your conversation, so personal data is not sent to the model provider.
  • On the way back, the gateway restores the original values in the model's response before you see it — you read real names and addresses; the model only ever saw tokens.

Token mappings are scoped to a single conversation, held only for the life of that conversation, and expire automatically. The categories of data that are tokenized are centrally defined and maintained by Axiad.

Auditability and feedback​

  • AI interactions are recorded in the audit log, so you can review how the assistant has been used in your tenant.
  • You can rate each assistant response with thumbs up or thumbs down.

Current limitations​

The following capabilities aren't included today:

  • No direct changes in Mesh — the assistant can't modify data inside Mesh on your behalf, for example renewing a certificate. Actions in external systems are possible only through the A2A agent integrations your administrators explicitly configure.
  • No outbound-data review — there is no review or approval step for outbound data before it is sent.
  • No multi-region or data-residency controls.
  • No usage-analytics view for the assistant.
  • No advanced feedback workflows, such as flagging or escalating a response.

Questions for your privacy review​

Some details that your privacy or security team may ask about aren't covered in this documentation, including:

  • Which large language model provider processes requests.
  • How long prompts and responses are retained.
  • Whether your data is used to train models.
  • Whether the assistant can be turned off for your tenant.

For your organization's data-processing and subprocessor terms, contact your Axiad representative.