Bring Box, SharePoint and Microsoft 365 into agents that act as the individual user, so the platform's own permissions apply on every call. Add a governed Skills framework, connector presets, transparent token refresh, and a one-command developer bundle. One policy plane across every content platform, not one tool per silo.
Content platforms and agent toolkits govern their own surface and nobody else's. Smartflow 1.9 lets an agent reach Box, SharePoint and Microsoft 365 as the signed-in human, so the platform enforces its own per-file permissions, sensitivity labels and conditional access with no ACL sync and no over-privileged service account. On top of that native enforcement, Smartflow adds what the platforms cannot: agent identity bound to a verified person, policy on destructive operations, compliance scanning of the content that flows through, and a tamper-evident audit trail — under one policy plane that spans every connector.
| # | Feature | Category | Who it's for |
|---|---|---|---|
| 1 | Box connector — ACL-native — hosted Box MCP over per-user OAuth (PKCE); every call runs as the human, Box enforces per-file permissions | Connector | Any Box customer running agents on enterprise content |
| 2 | SharePoint / Microsoft 365 connector — first-party smartflow-m365 server over Microsoft Graph with Entra on-behalf-of; SharePoint permissions, sensitivity labels & conditional access all apply natively | Connector | Microsoft-world enterprises |
| 3 | Governed Skills framework — packaged instructions + an allowed tool subset + owner & AD-group approval; enforced at the router so a skill can only call its declared tools | Skills | Platform teams standardising agent behaviour |
| 4 | Connector presets + admin API — one-call registration that writes the dashboard, proxy registry and catalog together; destructive tools auto-flagged restricted | Connector | Platform admins onboarding content sources |
| 5 | Transparent PKCE token refresh — refresh tokens persisted and used automatically; users no longer re-consent when an access token expires | Reliability | Every per-user OAuth connector |
| 6 | One-command developer onramp — a self-contained Docker bundle (proxy + Redis + dashboard + gateway), seeded demo key, local model support, 60-second first run | Developer | Developers evaluating or building on Smartflow |
Register Box's hosted MCP server as a first-party connector in one step. Agents can search, read and use Box AI over enterprise content, and every tool call executes with the calling user's own OAuth token via the authorization-code + PKCE consent flow. Because the call runs as the individual, Box applies its own per-file permissions. There is no ACL mirror to build, keep in sync, or get wrong, and no shared service account that can see more than any single user should.
Destructive and content-mutating tools — anything matching delete, remove, upload, write, update, move, copy, create or share — are automatically flagged restricted in the catalog at discovery time, so they require explicit approval beyond ordinary server access.
Invoice extraction from contract folders, multi-file Box AI queries, and content search that is automatically scoped to exactly what the caller can already see — with destructive operations gated behind approval.
Agent identity bound to a verified human, Shield policy on write/delete/share, during-call compliance scanning of returned document text, and a tamper-evident audit entry for every call — none of which the content platform provides on its own.
A first-party smartflow-m365 MCP server, served in-process by the gateway and reachable through Microsoft Graph. It introduces a new authentication mode, Entra on-behalf-of: the user's own Entra access token, captured at SSO sign-in, is exchanged for a downstream Graph token scoped to that user. Every SharePoint and OneDrive call then executes with the caller's identity, so SharePoint permissions, sensitivity labels and conditional access all apply natively. Users sign in once through Entra SSO; there is no second consent screen and no second login for M365 tools.
Five tools ship in 1.9, read-oriented by design:
m365_search — search SharePoint and OneDrive content the caller can accesssharepoint_list_sites — find sites by namesharepoint_list_items — list files and folders in a site's document librarym365_get_item — metadata for a drive itemm365_read_content — download a file's text content (size-capped for safe scanning)Setup reuses the same Entra app registration as Smartflow SSO: add delegated Graph permissions (for example Sites.Read.All, Files.Read.All), grant admin consent, and register the tenant, client and secret. The same on-behalf-of plumbing extends to Teams and Outlook in future releases.
Read policy or contract text into an agent with labels enforced, search a project site for exactly what the user is entitled to see, and inspect a document library — all without provisioning a broad service principal.
Microsoft's own agent governance covers Microsoft surfaces. Smartflow governs Microsoft and Box and everything else with a single policy, identity and audit plane — so a CISO sets one policy that follows the agent across every content platform, not one policy per vendor console.
Connectors ship as built-in presets that bundle everything the gateway needs: the MCP endpoint, the platform's OAuth or Entra endpoints, default scopes, the icon and category for the self-service catalog, and which tool-name patterns should be marked restricted. Registering one is a single admin call. Behind that call the gateway writes all three stores the platform reads from — the dashboard server list, the proxy router registry, and the self-service catalog entry — so the connector appears everywhere at once, consistently.
Onboarding a governed content source drops from a multi-step manual configuration to one call, with restricted-tool flags and catalog metadata applied automatically.
Per-user OAuth connectors now keep working across token lifetimes without pulling the user back into a consent screen. Refresh tokens are persisted alongside the access token with a longer retention window, and when an access token has expired the gateway exchanges the refresh token for a new one, persists it, and injects it into the call — all on the request path, transparently. Only when a refresh genuinely fails does the user need to re-consent.
Long-running and scheduled agents stay connected to Box and other PKCE connectors without a human re-authorising every hour.
A Skill is a first-class, governed object: a name and version, agents-style instructions, an explicit subset of tools the skill is allowed to call, optional input and output schemas, an owner, tags, a published flag, and the AD groups allowed to use it. Skills reuse the platform's existing group-based approval and publishing flows, so promoting a skill to production is the same governance step as approving any other capability.
Any agent framework can list and fetch skills through the MCP gateway with the skills/list and skills/get methods. The important part is enforcement: when a call is made in the context of a skill, the router checks the requested tool against that skill's declared allow-list. A skill built for contract summary cannot suddenly call a delete tool, even if the underlying server exposes one.
Other "skills" systems describe what an agent should do. A Smartflow skill also constrains what it can do — the allowed tool subset is enforced at the gateway on every call, so a published skill is a bounded, auditable capability rather than a suggestion.
A self-contained local stack that stands up in under a minute: the proxy, Redis, the dashboard, and a Caddy gateway that fronts them on a single loopback port. The installer generates its own secrets, starts the stack, waits for health, seeds a demo API key, and prints the OpenAI-compatible endpoint and dashboard URL. A prominent "dev mode, not production" banner makes clear this bundle uses local-only defaults.
Local model runtimes such as Ollama are wired in out of the box, so a developer can route to a model on their own machine through the same governed proxy path used in production. Bring your own upstream keys (OpenAI, Anthropic and others) when you want to test against hosted providers.
# fetch and start the dev bundle curl -sSL https://get.aperion.ai/dev | sh # or manage it directly ./smartflow-dev.sh up # start the stack, seed a demo key ./smartflow-dev.sh key # print the demo API key + endpoints ./smartflow-dev.sh status # health of every service ./smartflow-dev.sh down # stop
Evaluating Smartflow, or building against it, now starts with a single command instead of a manual multi-service setup — which multiplies how quickly the connectors and skills above can be tried.
Whether a call goes to a hosted connector like Box or to the in-process smartflow-m365 server, it runs the identical governed path: server- and tool-level access control, skills enforcement, Shield policy on destructive operations, compliance scanning of request and response content, semantic caching, per-tool cost tracking, and a tamper-evident audit record. Gateway-local connectors are dispatched in-process rather than over HTTP, and report healthy with the gateway itself, but they are subject to exactly the same controls as any remote server.
Images — pull the 1.9 runtime images from the Aperion private registry:
docker login registry.aperion.ai -u <your-issued-username> docker pull registry.aperion.ai/aperion/safechat-enterprise:v1.9.0 docker pull registry.aperion.ai/aperion/safechat:v1.9.0 docker pull registry.aperion.ai/aperion/safechat-dashboard:v1.9.0
SharePoint / M365 connector — the on-behalf-of exchange reuses your existing Entra SSO app registration. Add delegated Microsoft Graph permissions (Sites.Read.All, Files.Read.All), grant admin consent, then register the connector with your tenant ID, client ID and a client secret. Users must sign in through Entra SSO at least once so the gateway can hold their token for the on-behalf-of exchange.
Box connector — enable the Box MCP Server integration in the Box Admin Console, add Smartflow's callback URL as a redirect URI, and register the connector with the generated client ID and secret. Users complete a one-time consent to bind their Box identity.
Skills — no migration required. Create skills through POST /api/admin/mcp/skills; agents discover them through skills/list over the gateway. Skill enforcement is active as soon as a call carries a skill context.
No database migrations. Existing servers, catalog entries and PKCE tokens are fully compatible; refresh handling and connector registration are additive.