Enterprise operations

Interoperability and provider boundaries

Integrate a supported protocol without assuming universal model or tool compatibility.

AvailableImplementation review · November 6, 2026

In this document

Supported adapters are specific contracts
Qualify the outbound boundary
Keep simulation and real connectors distinct
No universal tool bridge is implied

Supported adapters are specific contracts#

Implemented text-provider adapters include OpenAI, OpenAI-compatible and Anthropic protocols. This describes adapter behavior, not a certification of every endpoint or model using those names. Confirm the exact request options, response shape, endpoint and credential configuration for the intended integration.

The supported chat boundary is bounded text generation. A familiar API shape does not imply streaming, image/audio inputs, unrestricted tools or arbitrary agent frameworks. Unsupported operations must remain explicit rather than bypassing governance through an approximate compatibility layer.

Qualify the outbound boundary#

Supported provider transport applies HTTPS destination admission, DNS checks with pinned resolution, redirect rejection, byte bounds, cancellation, deadlines and bounded retries. These mechanisms constrain a known request path; they do not establish a complete enterprise network firewall.

Tenant provider secrets use the supported protected storage path and are bound to their tenant/provider/endpoint context. Customer networks, private endpoints, identity controls, rotation and support access still need an agreed operational design.

Keep simulation and real connectors distinct#

Simulated adapters make no provider, token or FHIR calls. Authorized Epic sandbox support is limited to Patient read/search under dedicated credentials and scope. No clinical write, order placement or patient-impact workflow is implied.

A connector result is untrusted input to subsequent governance. Diagnostic snapshots and retained artifacts have their own access and retention requirements; an audit view is not permission to reveal every raw upstream field.

No universal tool bridge is implied#

Registered skills and evaluation action cases provide finite supported operations. They are not a general MCP gateway, arbitrary tool executor or autonomous agent platform. New integrations need schemas, allowed destinations/effects, authority checks, cancellation, idempotency and evidence qualification before they can be described as supported.

Verified compatibility matrix

Protocol adapters are not a certification of every vendor deployment or model. Expand each entry for authentication, operation and coverage limits.

Integration status from inspected adapter contracts
Provider / protocol	Integration status	Qualification
OpenAI text-chat adapter	Available	See protocol and deployment limits below
OpenAI-compatible text-chat adapter	Available	See protocol and deployment limits below
Anthropic text adapter	Available	See protocol and deployment limits below
Azure OpenAI	Exploring	See protocol and deployment limits below
Amazon Bedrock	Exploring	See protocol and deployment limits below
Google Vertex AI	Exploring	See protocol and deployment limits below
Customer-hosted text endpoint	Exploring	See protocol and deployment limits below

OpenAI text-chat adapter Available

Configuration: An explicit HTTPS base URL, configured model and destination-bound credential are required for a custom tenant binding.
Persisted tenant credentials use encrypted, write-only envelopes. Clearing a credential disables it; a failed binding does not switch providers.
An absent whole tenant configuration can use the intentional deployment default. A different endpoint cannot silently reuse that default credential.
Private destinations require an operator allowlist. Shared transport enforces destination binding, TLS, response bounds, cancellation and bounded retry.
Models: The tenant-configured model is admitted; the repository does not maintain a certified model compatibility list.
Capabilities: System, user and assistant text messages; supported text content parts normalize to text.
Bounded generation options and normalized chat completion responses.
Provider-reported token usage may be retained when present and valid.
Authentication: Configured Bearer credential, bound to the admitted tenant/provider/endpoint.
Operations: Non-streaming text chat/completions.
Streaming: Not supported by the governed text profile.
Tool Calls: Not supported; tool requests/responses are rejected.
Multimodal: Not supported; text-only content.
Usage: Validated provider-reported token fields when present; not verified cost accounting.
Limitations: Text chat only: no streaming, tool calls, image/audio input or arbitrary provider-specific options.
Compatibility is protocol-level implementation, not certification of every vendor endpoint or model. Qualify the configured deployment and model separately.
Provider usage metadata is not a verified invoice, cost calculation or complete Tokenomics capability.

OpenAI-compatible text-chat adapter Available

Configuration: An explicit HTTPS base URL, configured model and destination-bound credential are required for a custom tenant binding.
Persisted tenant credentials use encrypted, write-only envelopes. Clearing a credential disables it; a failed binding does not switch providers.
An absent whole tenant configuration can use the intentional deployment default. A different endpoint cannot silently reuse that default credential.
Private destinations require an operator allowlist. Shared transport enforces destination binding, TLS, response bounds, cancellation and bounded retry.
Models: Use a model supported by the configured endpoint and admitted tenant binding. A compatible API label does not guarantee compatible response metadata.
Capabilities: Configured HTTPS chat/completions path and Bearer credential.
Same supported text request and response profile as the OpenAI adapter.
Authentication: Bearer credential; endpoint-specific alternate authentication is not a generic adapter feature.
Operations: Compatible non-streaming chat/completions shape only.
Streaming: Not supported.
Tool Calls: Not supported.
Multimodal: Not supported.
Usage: Accepted only when the endpoint returns valid normalized token metadata; no vendor invoice reconciliation.
Limitations: Text chat only: no streaming, tool calls, image/audio input or arbitrary provider-specific options.
Compatibility is protocol-level implementation, not certification of every vendor endpoint or model. Qualify the configured deployment and model separately.
Provider usage metadata is not a verified invoice, cost calculation or complete Tokenomics capability.
No blanket Azure, local-model, cloud-marketplace or vendor certification is implied. Endpoint authentication and response shape must match the implemented protocol.

Anthropic text adapter Available

Configuration: An explicit HTTPS base URL, configured model and destination-bound credential are required for a custom tenant binding.
Persisted tenant credentials use encrypted, write-only envelopes. Clearing a credential disables it; a failed binding does not switch providers.
An absent whole tenant configuration can use the intentional deployment default. A different endpoint cannot silently reuse that default credential.
Private destinations require an operator allowlist. Shared transport enforces destination binding, TLS, response bounds, cancellation and bounded retry.
Uses the configured x-api-key and anthropic-version: 2023-06-01 protocol header.
Models: Use the configured model accepted by the endpoint; model availability must be checked for the deployment.
Capabilities: System messages are combined into the system field; user/assistant messages remain ordered.
Supports max_tokens, temperature, top_p and stop sequences within gateway bounds.
Maps reported input/output tokens to normalized usage fields when supplied.
Authentication: Configured x-api-key and fixed protocol-version header under the tenant endpoint binding.
Operations: Non-streaming text v1/messages, normalized to a completion envelope.
Streaming: Not supported.
Tool Calls: Tool-use responses are rejected; no tool execution.
Multimodal: Non-text blocks are rejected.
Usage: Reported input/output tokens mapped to normalized usage; no cost or billing guarantee.
Limitations: Text chat only: no streaming, tool calls, image/audio input or arbitrary provider-specific options.
Compatibility is protocol-level implementation, not certification of every vendor endpoint or model. Qualify the configured deployment and model separately.
Provider usage metadata is not a verified invoice, cost calculation or complete Tokenomics capability.
presence_penalty, frequency_penalty and seed are rejected by this adapter.
Non-text content blocks and tool-use responses are withheld as unsupported; no tool execution is provided.

Azure OpenAI Exploring

Configuration: Qualification must establish the exact endpoint path, authentication and request/response shape against the implemented adapter.
The current provider configuration rejects URL query strings; cloud-specific query/version requirements cannot be assumed to work.
Models: No verified Azure deployment/model matrix is recorded by this catalog.
Capabilities: Only a separately qualified endpoint matching the existing text adapter could use that path; no Azure-specific capability is claimed.
Authentication: No native Azure identity/token or api-key adapter is registered.
Operations: Unverified; no native Azure operation mapping.
Streaming: Not supported by the current governed text profile.
Tool Calls: Not supported.
Multimodal: Not supported.
Usage: No Azure-specific usage or cost integration.
Limitations: Exploring describes an unqualified integration path, not a committed release date or customer acceptance.
Do not relabel a generic compatible adapter as tested Azure support.

Amazon Bedrock Exploring

Configuration: Requires a separately designed and qualified authentication, endpoint and operation boundary before native support can be claimed.
Models: No Bedrock model qualification is established by the current adapter catalog.
Capabilities: No native Bedrock operation is implemented in the provider factory.
Authentication: No native AWS signing/credential exchange implementation in the model-provider adapters.
Operations: No native Bedrock operation mapping.
Streaming: Not supported.
Tool Calls: Not supported.
Multimodal: Not supported.
Usage: No Bedrock-specific usage or cost integration.
Limitations: Existing generic HTTPS transport is not a Bedrock integration.
No customer or model certification is asserted.

Google Vertex AI Exploring

Configuration: Requires a separately qualified endpoint, authentication and operation contract before native support can be claimed.
Models: No Vertex model qualification is established by this catalog.
Capabilities: No native Vertex operation is implemented in the provider factory.
Authentication: No native Google identity/token acquisition adapter is registered.
Operations: No native Vertex operation mapping.
Streaming: Not supported.
Tool Calls: Not supported.
Multimodal: Not supported.
Usage: No Vertex-specific usage or cost integration.
Limitations: A vendor’s compatible endpoint must independently satisfy the existing bounded protocol; the provider name does not establish compatibility.
No deployment or model certification is asserted.

Customer-hosted text endpoint Exploring

Configuration: An explicit HTTPS base URL, configured model and destination-bound credential are required for a custom tenant binding.
Persisted tenant credentials use encrypted, write-only envelopes. Clearing a credential disables it; a failed binding does not switch providers.
An absent whole tenant configuration can use the intentional deployment default. A different endpoint cannot silently reuse that default credential.
Private destinations require an operator allowlist. Shared transport enforces destination binding, TLS, response bounds, cancellation and bounded retry.
Qualify endpoint authentication, TLS/DNS, response schema, model behavior, resource limits and operational ownership for the specific customer environment.
Models: Customer-selected model remains unqualified until evaluated against the supported text and authority contracts.
Capabilities: Existing compatible text-chat adapter, conditional on successful deployment-specific qualification.
Authentication: Configured Bearer credential and approved HTTPS endpoint; alternate protocols require engineering.
Operations: Qualified compatible chat/completions only.
Streaming: Not supported by the current profile.
Tool Calls: Not supported.
Multimodal: Not supported.
Usage: Endpoint-supplied usage only when valid; no hardware utilization or full expenditure accounting.
Limitations: Customer deployment qualification remains required; no customer-qualified outcome is asserted.
No automatic private-network, air-gap, arbitrary local-model or zero-egress guarantee.
Text chat only: no streaming, tool calls, image/audio input or arbitrary provider-specific options.
Compatibility is protocol-level implementation, not certification of every vendor endpoint or model. Qualify the configured deployment and model separately.
Provider usage metadata is not a verified invoice, cost calculation or complete Tokenomics capability.

The governance boundary resolves authority and policy independently of model output, while each provider adapter has its own qualification requirements. Adapter architecture is not universal provider or tool availability. — **D14 · Provider-independent governance boundaries**
The governance boundary resolves authority and policy independently of model output, while each provider adapter has its own qualification requirements.
Adapter architecture is not universal provider or tool availability.

Only traffic routed through supported, configured Gateway paths receives those boundary controls. Other traffic is outside that enforcement path. Supported inline/API placement; not organization-wide network interception. — **D08 · Where the Gateway governs**
Only traffic routed through supported, configured Gateway paths receives those boundary controls. Other traffic is outside that enforcement path.
Supported inline/API placement; not organization-wide network interception.

Untrusted clients and content cannot grant authority. Server authorization, qualified adapters and scoped evidence each have separate responsibilities. Architecture boundaries; no certification or complete customer-environment qualification claim. — **D20 · Trust is established at each boundary**
Untrusted clients and content cannot grant authority. Server authorization, qualified adapters and scoped evidence each have separate responsibilities.
Architecture boundaries; no certification or complete customer-environment qualification claim.