The AI Assistant reads your data through a fixed set of sixteen tools. You never call them directly. The model picks what it needs to answer your question, and the mode you are in decides which of the sixteen it is allowed to touch.
The sixteen tools
| Tool | Returns |
|---|---|
get_analysis_overview | Analysis statistics: analysis mode, entity counts, risk counts by level and type, how many entities executed a risk (did-do), top risks, top impacted entities, entities with risks per system |
get_risk_details | Risk metadata: description, level, type, business process, ruleset, the functions and actions per system, and the number of impacted entities |
get_ruleset_risk | The ruleset definition of a risk as the analysis used it: per system and function, every matched action with the number of entities that match it and the number that executed it |
list_risk_entities | Entities affected by given risks. For users: HR data, lock status, executions of the risk actions, and number of roles. For roles: type, assigned users, and executions by the role holders |
aggregate_by_dimension | Affected entities grouped by one dimension, with entity count, risk count, executions, and entities with did-do per group |
get_user_risk_profile | One user's HR data, role counts per system, and every risk with level, type, business process, did-do, and executions |
explain_risk_for_entity | Why one user or role has one risk: per action, which single roles grant it (directly or through a composite role), how often it was executed and when last, and the did-do flag. Use it to decide which role assignment to remove |
get_role_risk_contribution | Every risk a single or composite role contributes to, with entities affected, the risk actions the role grants, and the role users per system |
get_entity_assignments | Short assignment summary. For a user: HR data and roles in a system. For a role: type, composite or child roles, user count, and authorization objects |
get_role_details | Role details: structure, users (direct and through a composite role), granted actions with executions and last execution date, and for single roles the authorization objects with their field values |
find_access | Who can execute a transaction or holds an authorization value: the single roles that grant it (wildcards and ranges included), the composite roles that contain them, and optionally the users |
get_user_usage | The transactions a user actually executed: per system, the execution count, last execution date, and the current roles that grant it. Optionally only the actions of one risk |
search_entities | Users or roles matching a name, case-insensitive: exact matches first, then prefix, then substring |
get_remediation_stats | Remediation progress for risks: impacted, remediated, remaining, entities the plan leaves open, complexity breakdown, and usage data missing in the risk systems |
get_remediation_recommendations | Remediation overview for risks. Without an entity name, aggregated statistics and the most complex entities with their instructions. With one, that entity's recommendations, its "To review" entries, and why the plan leaves the risk open |
get_did_do_changelog | Change documents (CDHDR, with CDPOS field changes when available) created through the risk actions by entities with confirmed did-do: user, action, object, change type, date, table, field, old and new value |
Most tools that return lists are paged. When more rows exist, the model is told and can request the next page.
Aggregation dimensions
aggregate_by_dimension accepts one of seven dimensions: system, business_process, user_group, department, full_name, hr_function, location. The HR-derived dimensions only return groups when an HR_DATA file is loaded on the data source.
Availability depends on what you opened
The assistant runs against one of two data scopes, and the scope matters more than the mode.
Data source scope, when you open the assistant on a loaded data source with no analysis result, exposes five tools: search_entities, get_entity_assignments, get_role_details, find_access, and get_user_usage. You can explore who holds what, who can execute a transaction, and what a user actually executed. There is no risk data to query yet, so nothing else is available whichever mode you pick.
Analysis scope, when you open it on an analysis result, exposes tools per mode:
| Mode | Tools available | Count |
|---|---|---|
| Conversation | all sixteen | 16 |
| Remediation Advisor | list_risk_entities, get_risk_details, get_entity_assignments, get_remediation_recommendations, search_entities, get_role_details, find_access, explain_risk_for_entity, get_user_usage, get_role_risk_contribution | 10 |
| Root Cause Analysis | get_risk_details, get_role_risk_contribution, get_user_risk_profile, search_entities, aggregate_by_dimension, get_role_details, find_access, explain_risk_for_entity, get_ruleset_risk | 9 |
| Recommendation Advisor | get_remediation_recommendations, get_remediation_stats, get_risk_details, list_risk_entities, get_analysis_overview, search_entities | 6 |
| Changelog Analysis | get_risk_details, list_risk_entities, get_entity_assignments, get_user_risk_profile, aggregate_by_dimension, get_did_do_changelog, explain_risk_for_entity, get_user_usage | 8 |
| Audit Finding | list_risk_entities, get_risk_details, aggregate_by_dimension, get_entity_assignments, explain_risk_for_entity, get_ruleset_risk | 6 |
| Executive Summary | get_risk_details, aggregate_by_dimension, search_entities | 3 |
Narrowing the toolset is deliberate. A mode with three tools cannot wander into remediation data mid-answer, which is what keeps an executive summary short and an audit finding on topic. If an answer is missing something you expected, the mode probably did not have the tool for it, so switch to Conversation and ask again.
get_did_do_changelog is reachable from Conversation and Changelog Analysis only, and needs Did-Do analysis enabled on the run with CDHDR and CDPOS loaded on the data source.
How much each tool returns
Every tool respects the per-query limits in Settings > AI Assistant. Those caps are what stop one question from pulling a 40,000-row result into the context window. See Configuration for defaults and ceilings.