Concepts → AI App

About

AI Apps are interactive applications that run natively within Incorta, built directly on top of Incorta's data and semantic layer. While dashboards are designed for viewing and filtering data, AI Apps go further by supporting full user interaction, including form inputs, action triggers, what-if simulations, machine learning model front-ends, and custom workflows, all while querying live Incorta data at Engine speed, with no ETL, no data exports, and no separate hosting infrastructure required.

This capability closes a critical gap for use cases that exceed what dashboards can offer, such as capturing user input, taking action on a record, running a forecasting model, or blending Incorta data with an external source. Previously, these scenarios required building and hosting separate applications outside of Incorta, introducing friction around authentication, data access, deployment, and governance. AI Apps address this by providing a managed platform for authoring, deploying, and running full applications directly within Incorta. App code executes in a secure, sandboxed environment and accesses live data through a purpose-built SDK, with all data access governed by the signed-in user's identity and Incorta's row-level security rules.

For details about how to use the feature, refer to Tools → AI App Manager.

App roles

AI Apps introduces two user roles:

App lifecycle

A data AI App moves through the following states, visible as colored status badges on each app card:

When an App Manager publishes a new version of an app, the previously published version is replaced automatically, and the app URL does not change. Users continue accessing the app at the same address without disruption.

Security model

AI Apps are designed with security isolation at every layer:

• Sandboxed runtime
  Every app runs in its own isolated container with no direct access to the database, the file system, or any other app. The sandbox prevents access to disk, databases, and Incorta directly, so even a long-lived published app cannot reach outside its container.
• Identity-aware access
  All data access flows through Incorta's authenticated APIs under the signed-in user's identity. Row-level security is enforced automatically for every user who opens an app.
• Security scan on publish
  When an App Manager selects Publish, Incorta runs an automated security scan before completing the publish action. If blocking vulnerabilities are found, publishing is blocked until the App Manager resolves them. Non-blocking warnings allow publishing to proceed and are recorded in the scan report.
• No credentials in app code
  Apps access Incorta data through the Incorta SDK, which manages authentication automatically. App code does not handle raw database connections or credentials.

Security scan checks

The Scanning Report dialog displays the result of each check before publishing:

Each check returns Passed (green), Warning (yellow), or Failed (red).

The overall result is displayed as Passed, Passed with warnings, or Failed.

SDK and persistent storage

Apps are built using the Incorta AI Apps SDK, a purpose-built library that provides:

• Data access: Query live Incorta schemas and Business Schema views without managing connections.
• Secrets management: Store and retrieve sensitive configuration values (API keys, tokens, database passwords) securely, without embedding them in app code.
• Persistent storage: Save and retrieve app-specific data across sessions, enabling tools that remember state, capture user input, and accumulate data over time.

Supported frameworks

The initial release of AI Apps supports Streamlit as the application authoring framework, as well as a custom full-stack framework that includes Python FastAPI and JavaScript. The app entry point is an app.py file, with optional supporting files such as requirements.txt. Support for additional frameworks beyond Streamlit is planned for future releases.

AI-assisted development

AI Apps includes an AI-assisted development kit that accelerates local app development. App Managers can connect a coding agent, like Claude Code, to the platform via a simple install command, giving it access to live MCP tools, platform rules, and working templates to help write app code. Sessions last about six hours and auto-refresh, and since the agent acts on the developer's behalf, its work should be supervised. Combined with each app's own lifecycle, versioning, and persistent storage, this AI-assisted workflow helps developers move faster from idea to a working AI App.

Versioning

AI Apps supports versioned publishing. An App Manager can work on a new Draft version of a published app without affecting the current live version. The version number (for example, v1) is displayed in the editor breadcrumb. When the new version is ready, a single Publish action replaces the old version while the URL remains unchanged, and App Viewers experience a seamless transition.
Published apps are accessible at a stable URL in the following format:

Copy
<cluster_url>/data-apps/my-apps/<tenant_name>/<app_name>/

Availability and pricing

AI Apps is available on Cloud deployments only. AI Apps is a metered, pay-as-you-go capability. Compute, memory, and data transfer are tracked per app and per tenant, and billed based on actual usage.