Data Integration

Agents are only as useful as the data they can reach. Data integration is how you connect Hoziron agents to your systems of record (SoR) — insurance-specific systems like claims-core and policy-admin platforms (Guidewire, Duck Creek, and similar), plus general-purpose tools (notifications, search).

The integration surface is uniform: everything is an installed integration-type package that exposes named tools, connected and managed the same way regardless of what's behind it. There is no separate "database connector" or "file-system connector" concept in the platform — if you need database or file-store access, you install (or author) an integration package that talks to it and exposes tools for the specific operations you need. See Databases and File systems for what this means concretely.

What you'll find here

GuideDescription
APIsThe two ways to expose an external API as tools — MCP servers and REST/SOAP adapter packages — and the integration lifecycle that manages both
DatabasesWhy there's no built-in database connector, and how to reach one through an integration package
File systemsDocument/file access through competency-declared permissions and integration packages
CredentialsThe credential vault — write/rotate/delete only, no read-back by design

The two integration mechanisms

  1. MCP servers. An integration-type package ships payload/mcp.json, describing an MCP server process. Once installed, hoziron-cli integration connect <name> starts it, and the agent's competency binds to it either directly (integrations: — a fixed, universal MCP) or via a contract (contracts: — a named, swappable tool surface like policy-admin or claims-core, resolved to whichever installed integration currently declares that contract). See ADR-051.
  2. REST/SOAP adapter packages. An integration-type package ships payload/adapter.json (a JSON contract: base URL, auth reference, a normalised operation catalogue) plus Starlark transform files for request/response shaping. See ADR-057 and APIs § REST/SOAP adapter packages.

Both roads end at the same lifecycle commands (hoziron-cli integration connect/disconnect/reconnect/status/tools) and the same credential vault.

How data flows through Hoziron

Every outbound call passes through the mediation seam before it leaves the box — PII is detected and tokenised by default, hydrated only for destinations with an explicit hydrate rule in the carrier PII policy. See Security § PII Engine.

Security considerations

  • Credentials live in the credential vault or an environment variable referenced by name — never inline in config.toml or a package manifest.
  • PII hydration to a named tool destination is deny-by-default: an unlisted (destination, PII-type) pair always tokenises. See PII Engine § Tool dimension.
  • REST/SOAP adapter contracts carry no PII-specific annotations — detection is content-based and transport-blind, not declared by the package author (a deliberate ADR-049 boundary: PII policy is operator-level, never package-author-level).