Oasis AAM · LangGraph agents

Sign in with your company account. The report-assistant acts on your behalf through Oasis AAM; finops-reconciler runs autonomously as itself.

Sign in with PingFederate

Same report-assistant with no agent secret (its AKS workload identity, verified by PingFederate): agent-wi.aam.oasissandbox22.com

Oasis AAM · LangGraph agents

What do you need from the finance bucket?

The agent asks Oasis AAM for access, then works with the tools it is granted.

LangGraph finops-reconciler

Runs unattended as its own identity (client credentials). It asks Oasis AAM for access to the MinIO finance bucket, reconciles the AP sub-ledger against GL 2000-AP and writes recon/exceptions-latest.json. "Also try to fix the GL" asks for a write its MinIO policy denies.