The AI Assistant reads your data through a fixed set of eleven tools. You never call them directly. The model picks what it needs to answer your question, and the mode you are in decides which of the eleven it is allowed to touch.
The eleven tools
| Tool | Returns |
|---|---|
search_entities | Users or roles matching a name substring, case-insensitive. Result count is configurable |
get_entity_assignments | Role and permission assignments for users or roles, in their systems |
get_risk_details | Risk metadata: severity, type, business process, and the functions and actions it covers per system |
list_risk_entities | Entities affected by given risks, with HR information for users or usage statistics for roles |
get_analysis_overview | Analysis statistics: risk counts by severity and type, top N risks, top N impacted entities, system breakdown |
get_role_risk_contribution | Every risk a role contributes to, with user count and usage statistics |
get_user_risk_profile | Every risk for given users, with HR information, severity, and execution status |
aggregate_by_dimension | Risk data grouped by one dimension, with entity count, risk count, and execution statistics per group |
get_remediation_stats | Impacted count, remediated count, and complexity breakdown for given risks |
get_remediation_recommendations | Remediation overview for risks. Without an entity name, aggregated statistics and the most complex entities; with one, detailed recommendations for that entity |
get_did_do_changelog | Transaction changelog entries (CDHDR/CDPOS) for entities that actually executed a risky action. Header data always, field-level detail once the CDPOS index is built |
Aggregation dimensions
aggregate_by_dimension accepts one of seven dimensions: system, business_process, user_group, department, full_name, hr_function, location. The HR-derived dimensions only return groups when an HR_DATA file is loaded on the data source.
Availability depends on what you opened
The assistant runs against one of two data scopes, and the scope matters more than the mode.
Data source scope, when you open the assistant on a loaded data source with no analysis result, exposes two tools: search_entities and get_entity_assignments. You can explore who holds what, but there is no risk data to query yet, so nothing else is available whichever mode you pick.
Analysis scope, when you open it on an analysis result, exposes tools per mode:
| Mode | Tools available | Count |
|---|---|---|
| Conversation | all eleven | 11 |
| Remediation Advisor | list_risk_entities, get_risk_details, get_entity_assignments, get_remediation_recommendations, search_entities | 5 |
| Root Cause Analysis | get_risk_details, get_role_risk_contribution, get_user_risk_profile, search_entities, aggregate_by_dimension | 5 |
| Recommendation Advisor | get_remediation_recommendations, get_remediation_stats, get_risk_details, list_risk_entities, get_analysis_overview, search_entities | 6 |
| Changelog Analysis | get_risk_details, list_risk_entities, get_entity_assignments, get_user_risk_profile, aggregate_by_dimension, get_did_do_changelog | 6 |
| Audit Finding | list_risk_entities, get_risk_details, aggregate_by_dimension, get_entity_assignments | 4 |
| Executive Summary | get_risk_details, aggregate_by_dimension, search_entities | 3 |
Narrowing the toolset is deliberate. A mode with three tools cannot wander into remediation data mid-answer, which is what keeps an executive summary short and an audit finding on topic. If an answer is missing something you expected, the mode probably did not have the tool for it, so switch to Conversation and ask again.
get_did_do_changelog is reachable from Conversation and Changelog Analysis only, and needs Did-Do analysis enabled on the run with CDHDR and CDPOS loaded on the data source.
How much each tool returns
Every tool respects the per-query limits in Settings > AI Assistant. Those caps are what stop one question from pulling a 40,000-row result into the context window. See Configuration for defaults and ceilings.