Connect Your Enterprise. Govern Every Interaction.
Enterprise integration is no longer only about moving information between applications.
Modern organizations must connect business systems, APIs, events, data services, operational environments and AI-enabled workflows while maintaining security, visibility and control.
iShield Link provides a governed integration foundation for connecting enterprise capabilities and coordinating the interactions between them.
Integration that connects. Governance that gives control.
iShield Link sits between enterprise applications, partners, data services, operational systems and AI-enabled services — so the interactions between them are designed, controlled and observed in one place.
Business value
Connect existing investments with new digital capabilities, and reuse each connection instead of rebuilding it.
Technical value
One governed layer for interfaces, mediation, events, orchestration and the policies applied to them.
Operational value
Integration services that are visible, versioned and recoverable by the team that runs them.
Platform architecture
The Governed Interaction Path
Follow one enterprise interaction through Link: a request enters through a managed interface, passes a policy check, is mediated and published as an event, drives a workflow and reaches its target — with evidence and an operations view at every step, and a defined path when delivery fails.
System
Interface
Policy check
Integration service
Event
Failure path
Evidence
Observability
Use the arrow keys on a step to move along the path. The panel below the diagram describes the selected step.
Applications & partnersWhere interactions start and end
Interfaces & eventsManaged entry points
Integration servicesMediation and orchestration
Control & operationsPolicy, evidence, recovery
System · Step 1 of 10
Source application
A business application, partner or service starts an interaction — for example, an order, a case update or a data request.
Who acts
The calling application, under its owner's credentials
Evidence
Caller identity on the request
01 SystemApplications & partners
Source application
A business application, partner or service starts an interaction — for example, an order, a case update or a data request.
Who acts
The calling application, under its owner's credentials
Evidence
Caller identity on the request
02 InterfaceInterfaces & events
Managed API call
The request arrives at a published interface with an agreed contract instead of a direct connection into the target system.
Illustration of a governed integration pattern — not a product screen. Which steps apply, and how, depends on the integration pattern and how it is implemented and configured.
Capabilities
From disconnected systems to coordinated enterprise capabilities
01
API Connectivity & Management
Expose, connect and manage application capabilities through governed API interfaces and integration services.
Support structured interactions between internal platforms, external applications and enterprise services.
Bring visibility, monitoring and operational management to integration services so teams can investigate failures, understand dependencies and maintain service continuity.
Provide an architectural foundation for connecting AI-enabled services and enterprise workflows through governed interfaces, subject to the controls and capabilities implemented for each integration pattern.
The existing Link module inventory, organised by architectural plane. Each module shows its own pattern, controls, failure handling and cross-platform boundary.
Interfaces & connectivity · Where systems, partners and devices meet Link.
Interfaces & connectivity
API Gateway
Expose, govern, and secure APIs across internal and partner ecosystems.
The managed front door for enterprise capabilities: one place to publish an interface, decide who may call it and see how it is used.
01
Consumer calls
An application or partner calls a published API.
02
Identify
The caller's credentials and scope are checked.
03
Apply policy
Rate limits and access rules are applied.
04
Route
The request goes to the right backend and version.
05
Record
Usage and errors are recorded for operations.
Enterprise challenges
Interfaces published by each team in its own way
Partner access granted case by case
No shared view of who calls what
Capabilities
Publish internal and partner APIs from a managed catalogue
Route requests to the right backend service and version
Apply authentication, authorisation and rate limits at the boundary
Version interfaces and retire old versions in a planned way
Patterns and use cases
Expose a system of record to internal teams through a stable contract
Give partners scoped access to selected services
Put a legacy service behind a modern interface without changing it
Architectural components
API catalogue and contracts
Gateway runtime and routing rules
Consumer applications and credentials
Usage and error records
Roles and permissions
API owner: Defines the contract and who may use it
Integration team: Publishes, versions and routes the API
Security team: Sets authentication and access rules
Governance and security
Access is granted per consumer and per scope
Changes to published contracts follow the integration lifecycle
Credentials can be rotated or revoked centrally
Failures and recovery
A backend is unavailable: The caller receives a controlled error and the failure is visible to operations.
A consumer exceeds its limits: Requests are throttled according to the policy set for that consumer.
Monitoring and observability
Calls, latency and errors per API and consumer
Version usage, to plan retirement
Standards context
OpenAPI: Reference format for describing API contracts.
OAuth 2.0 and OpenID Connect: Common patterns for delegated authorisation and sign-in.
OWASP API Security Top 10: Reference list of API risks used to review design and policy.
Cross-platform
Other iShield platforms can expose or consume services through managed APIs; what is exposed depends on how each platform is implemented and configured.
Business outcomes
Reusable interfaces instead of one-off connections
Brings operational-technology data into enterprise processes through a controlled boundary, keeping industrial networks separate from business systems.
01
Collect
Readings or events are collected at the site.
02
Check boundary
Zone and direction rules are applied.
03
Normalise
Data is converted to an enterprise format.
04
Publish
Enterprise consumers receive the data.
Enterprise challenges
Plant data trapped in operational systems
Direct connections that weaken network separation
Different protocols on every site
Capabilities
Read data from industrial protocols and systems where supported
Publish operational events to enterprise consumers
Apply zone and direction rules at the boundary
Patterns and use cases
Equipment readings feeding maintenance and quality processes
Production events informing planning in the ERP
Site data shared with central analytics
Architectural components
Site connectors
Protocol adapters
Boundary rules
Operational event channels
Roles and permissions
OT engineer: Configures site connections and boundary rules
Enterprise consumers: Use the published operational data
Governance and security
Data direction and zones are set per site
Changes to site connections follow the integration lifecycle
Failures and recovery
A site connection drops: The gap is visible to operations and data can be caught up where buffering is configured.
Monitoring and observability
Connection status per site
Data flow from each site
Standards context
NIST Cybersecurity Framework: Reference for identifying and protecting operational boundaries.
Cross-platform
Operational data can inform maintenance, quality and planning on other iShield platforms where implemented and configured.
Business outcomes
Operational data in enterprise processes without direct network links
Control plane · Where access, policy, AI use and tenancy are decided.
Control plane
AI Integration
Governed access to LLMs and AI agents with policy controls.
Connects AI-enabled services to enterprise systems through governed interfaces, so AI use follows the same access and evidence rules as any other integration.
01
Request
An AI service requests data or an action.
02
Check scope
Its identity, tools and data scope are checked.
03
Approve
A person approves sensitive actions.
04
Execute
The call runs through an approved interface.
05
Record
The request and outcome are recorded.
Enterprise challenges
AI tools connected directly to sensitive systems
No record of what an AI service accessed or triggered
Different rules for each AI provider
Capabilities
Route AI requests through managed interfaces
Limit which tools and actions an agent may use
Require human approval for sensitive actions where configured
Record AI-initiated requests and outcomes
Patterns and use cases
An assistant that reads approved records through managed APIs
An agent that proposes actions for a person to approve
Switching AI providers behind a stable interface
Architectural components
AI provider connections
Tool and action allow-lists
Approval steps
AI activity records
Roles and permissions
AI product owner: Defines what the AI service may do
Security and data owners: Set access and data rules
Business approvers: Approve sensitive AI-proposed actions
Governance and security
AI services use the same identity and policy controls as other consumers
Sensitive actions can require human approval
Failures and recovery
An AI request falls outside its allowed scope: It is blocked and recorded for review.
Monitoring and observability
AI-initiated requests, blocked actions and approvals
AI and automation
This module is the integration layer for AI-enabled services. Decisions on sensitive actions stay with people where approval is configured.
Standards context
ISO/IEC 42001: AI management-system reference for governing AI use.
OWASP API Security Top 10: Reference for risks at the interfaces AI services call.
Cross-platform
AI-enabled features on other iShield platforms can reach enterprise services through Link where this is implemented and configured.
Business outcomes
AI use that follows enterprise access rules
A record of what AI services accessed and triggered
Enable business systems to exchange information and coordinate processes across functional boundaries.
APIs and digital services
Make enterprise capabilities accessible through managed interfaces and reusable integration patterns.
Events and workflows
Coordinate event-driven interactions and multi-system processes with appropriate operational controls.
Data services
Support controlled movement and transformation of information between relevant enterprise systems.
AI-enabled services
Connect AI-assisted applications and agents to enterprise services through governed integration patterns, with access and oversight appropriate to the use case.
Enterprise use cases
18 integration scenarios across business, technology, industrial and AI environments. Choose a category, then open a scenario to see its integration flow and the Link modules involved.
18 use cases shown
Sales & Customer Experience
A won opportunity has to become an order, a delivery and an invoice in other systems.
Industrial equipment, operational technology and enterprise business systems often operate across different protocols, security zones and availability requirements.
Enterprise AI applications need controlled access to business systems and actions without bypassing authorization, accountability or operational controls.
Typical systems in an enterprise integration estate. Connectivity to any named product depends on the connector or interface used in each implementation.
Request a complimentary integration assessment. Our architects will map your current systems to the iShield product suite and recommend the optimal connectivity path.
Standards and practices relevant to integration architecture and governance discussions. They are listed as context; this page makes no certification or conformity statement against them.
OpenAPI Interfaces
Describing HTTP API contracts so consumers and providers agree what an interface does.
AsyncAPI Events
Describing event channels and messages for event-driven integration.
OAuth 2.0 and OpenID Connect Identity
Delegated authorisation and sign-in patterns at API boundaries.
OWASP API Security Top 10 API security
A reference list of common API risks for reviewing design and policy.
ISO/IEC 27001 and 27002 Information security
Security-management and control guidance for access, change and logging.
ISO/IEC 27701 Privacy
Privacy-management guidance where integrations carry personal data.
ISO/IEC 20000 Service management
Incident, change and service-level practice for operating integration services.
ISO/IEC 42001 AI management
Management-system guidance for governing AI-enabled integrations.
NIST Cybersecurity Framework Cyber risk
Identify, protect, detect, respond and recover — a framing for integration risk.
Applicable data-protection requirements Data protection
Laws and regulations that apply where integrations move personal data, such as GDPR or national data-protection laws.
Integration operations
Run integration as an operated service
Integration services are watched, recovered and changed by the team that owns them, with the evidence to show what happened.
See
Health and status of each integration service
Failures, delays and messages held for review
Which flows depend on which connections
Act
Retry, replay or correct a failed exchange
Roll back a faulty release to its previous version
Pause a consumer or partner within its policy
Show
Policy decisions with their reasons
Change and release history
AI-initiated requests, approvals and blocked actions
Operational outcomes
Fewer point-to-point connections to maintain as systems change
Integration failures seen and owned by the team that runs them
Production changes that are versioned, approved and reversible
Access rules applied the same way at every interface
A record of who and what used each enterprise service
Why Link
Built for enterprise architecture and operational control
For enterprise architects:
Establish clearer integration patterns and more coherent connectivity across the technology landscape.
For integration teams:
Support the development, operation and maintenance of integration services through a coordinated platform approach.
For security and governance leaders:
Incorporate appropriate security, access and accountability requirements into integration design and operation.
For digital transformation leaders:
Connect existing investments with new digital capabilities without requiring every system to be replaced.
Cross-platform boundaries
Link connects. Each platform keeps its responsibility.
Exchanges between iShield platforms depend on how they are implemented and configured.
Integration and connectivity: interfaces, mediation, events, orchestration and the policies applied to them.
Connects systems; does not become the system of record for the data it carries.
Enterprise service and technology operations.
Integration incidents and changes can be managed in Nexus where it is used.
AI becomes more useful when it can interact appropriately with enterprise systems and processes.
It also introduces new integration challenges involving permissions, sensitive information, tool execution, operational accountability and oversight.
iShield Link's AI-era architecture addresses the integration layer of these challenges, connecting AI-enabled capabilities with enterprise services through governed interfaces.
Explore the dedicated AI-era experience to understand the supported integration patterns and control capabilities.
Where integration must be secure, auditable, controlled, and resilient.
Energy & UtilitiesOil & GasGovernment & Public SectorFinancial ServicesHealthcareTelecommunicationsCritical InfrastructureTransportationManufacturing & Industry 4.0Mining & MetalsSmart Cities & UtilitiesLarge Enterprise GroupsRegulated Multinationals
Deployment & Tenancy
iShield Link runs the way your business requires
SaaS by default
Managed multi-tenant SaaS with continuous updates and zero infrastructure to operate.
Hybrid when needed
Control plane in iShield cloud, data plane in customer cloud (AWS, Azure, GCP, OCI).
One architecture, every model
SaaS, single-tenant cloud, hybrid and on-prem share the same code, APIs and upgrade path. No deployment lock-in.
Deployment Architecture
Control plane vs data plane — Link
The same product, deployed three ways.
Control Plane
iShield-managed · Link services
iShield Cloud
Orchestration & APIsTenant router, policy engine, AI gateway
Identity & RBACSSO, SCIM, JIT provisioning
Admin consoleTenant admin, audit, observability
Data Plane
iShield-managed
Tenant database
BYOK encryptionCustomer-managed KMS key wrap
Control plane owner
iShield
Data plane owner
iShield
Network egress
Managed inbound/outbound
Upgrades
Continuous, zero-downtime
Best for
Fastest time-to-value, global teams
Same codebase, same APIs, same upgrade path across all three models — no deployment lock-in.
Capability catalogue
Explore iShield Link Capabilities
Enterprise integration, governed connectivity and intelligent orchestration.
iShield Link connects enterprise applications, data, partners and industrial systems through managed APIs, business events and integration flows. Policy, data-protection and access controls apply to each interaction as configured, and audit and lineage records keep the activity traceable. The catalogue also lists AI-enabled solution components that rely on Link for connectivity and governed data access; their business logic and decisions stay with the platform that owns each domain.
Category
Architectural role
76 of 76 capabilities shown
Integration & Connectivity (12)
Connect applications, data sources, partners, identity services and industrial systems through reusable connectors and integration flows.
Link integration module
Catalogue of reusable connectors for applications, databases and services, so integrations reuse managed connections instead of one-off code.
Used in 1 solution
Link integration module
Designs and runs integration flows that move and transform data between connected systems.
Used in 1 solution
Link integration module
Exchanges structured business documents with trading partners through B2B and EDI flows.
Used in 1 solution
Link integration module
Connects industrial equipment and plant systems to enterprise applications through the OT Bridge module.
Used in 1 solution
Link integration module
Connects industrial protocols and plant data historians to enterprise systems through the OT Bridge module.
Used in 1 solution
Link integration module
Runs integration workloads close to sites and equipment, where data is processed locally before it reaches central systems.
Used in 1 solution
Cross-product solution component
Aligns equipment and tag naming from different plant systems into consistent asset references.
Used in 1 solution
Link integration module
Connects to the organisation's identity provider so integrations and solution flows use existing workforce identities.
Used in 1 solution
Link integration module
Passes privileged-access requests from integration and identity flows to the organisation's privileged access management tool.
Used in 1 solution
Link integration module
Connects customer sign-up and sign-in journeys to external identity-verification services.
Used in 1 solution
Link integration module
Provides a federated view across connected data sources, so approved consumers can query data where it is held.
Used in 1 solution
Shared platform service
Describes the data products available through the data fabric so teams can discover and request them.
Used in 1 solution
API, Events & Orchestration (5)
Publish and manage APIs, distribute business events, keep message contracts consistent and coordinate multi-step and AI-assisted interactions.
Link integration module
Publishes, secures and documents APIs, and gives internal and partner developers a portal to discover and use them.
Used in 1 solution
Link integration module
Distributes business events between producers and consumers, so systems react to change without direct coupling.
Used in 1 solution
Link integration module
Keeps message and event contracts versioned and consistent, and allows recorded events to be replayed after a correction.
Used in 1 solution
Link integration module
Routes requests from applications and agents to approved AI model providers through one governed entry point.
Used in 1 solution
Shared platform service
Coordinates which tools an AI agent may call, what context it may keep and where a person must approve before an action proceeds.
Used in 1 solution
Governance, Policy & Trust (15)
Policy, data-protection and access controls that integrations and AI-enabled components pass through, as configured for each implementation.
Shared platform service
Evaluates residency, consent and cost policies before data or AI requests are passed on.
Used in 1 solution
Shared platform service
Evaluates policies written as code against requests and configuration changes, so rules are versioned and reviewable.
Used in 1 solution
Shared platform service
Applies policies that respect the separation of plant network zones when industrial data moves toward enterprise systems.
Used in 1 solution
Shared platform service
Checks recorded consent before personal data is shared through an integration.
Used in 3 solutions
Shared platform service
Masks or removes personal data from records moving through integration flows where policy requires it.
Used in 2 solutions
Shared platform service
Screens prompts and model responses against policy and removes personal data before it reaches an AI model.
Used in 1 solution
Shared platform service
Routes data and requests to the regions or environments permitted by residency policy.
Used in 2 solutions
Shared platform service
Applies the tenant-separation and region rules configured for each tenant of a multi-tenant service.
Used in 1 solution
Cross-product solution component
Requests time-limited access for a specific task and routes it for approval, instead of relying on standing access.
Used in 1 solution
Cross-product solution component
Collects access data from connected systems and routes periodic access reviews to the responsible reviewers.
Used in 1 solution
Cross-product solution component
Highlights combinations of access rights that conflict with segregation-of-duties rules, for review.
Used in 1 solution
Cross-product solution component
Passes risk and fraud signals into customer sign-in journeys, so additional verification can be requested where policy requires.
Used in 1 solution
Shared platform service
Controls which features each tenant or plan can use, based on its entitlements.
Used in 1 solution
Shared platform service
Routes proposed actions to the right people for approval and records the decision before anything proceeds.
Used in 1 solution
Cross-product solution component
Applies policy and approval checks to automated security playbook actions before they reach connected systems.
Used in 1 solution
Observability & Lifecycle (6)
Audit, lineage, evaluation, usage and tenant-lifecycle capabilities that keep integrations and AI use traceable and operable.
Shared platform service
Provides each tenant with its own stream of audit events for review and export.
Used in 1 solution
Shared platform service
Runs evaluation and adversarial test sets against AI components before and after changes.
Used in 1 solution
Shared platform service
Records where data came from and how it was transformed as it moves through integrations.
Used in 2 solutions
Shared platform service
Measures API and integration usage per tenant and applies the rate limits configured for each plan.
Used in 1 solution
Shared platform service
Coordinates provisioning, suspension and offboarding of tenants across connected services.
Used in 1 solution
Cross-product solution component
Detects configuration drift from the declared state and prepares corrective changes for approval.
Used in 1 solution
AI Agents & Cross-Product Solutions (38)
Domain AI agents, copilots and solution components that combine Link with other iShield platforms. Link provides connectivity, governed data access and visibility; business logic and decisions stay with the owning platform and the people accountable for them.
Cross-product solution component
Runs customer sign-up and sign-in journeys, including passwordless, social and multi-factor options as configured.
Used in 1 solution
Domain AI agent or copilot
Suggests categorisation, priority and likely assignment for new IT incidents, for the service desk to confirm.
Used in 1 solution
Domain AI agent or copilot
Estimates the risk of a proposed IT change from its context and history, to inform change review.
Used in 1 solution
Domain AI agent or copilot
Produces summaries of tickets, conversations and records for people to review.
Used in 2 solutions
Domain AI agent or copilot
Flags unusual patterns in operational telemetry for investigation.
Used in 1 solution
Domain AI agent or copilot
Correlates events and changes to suggest likely causes of an operational issue.
Used in 1 solution
Domain AI agent or copilot
Suggests the approved runbook that best matches an operational issue.
Used in 1 solution
Domain AI agent or copilot
Prepares remediation steps from approved runbooks; steps run only where configured and after the required approval.
Used in 1 solution
Domain AI agent or copilot
Flags unexpected changes in cloud spend for the teams responsible.
Used in 1 solution
Domain AI agent or copilot
Suggests how applications map to business capabilities, to support portfolio analysis.
Used in 1 solution
Domain AI agent or copilot
Summarises technical-debt indicators per application to inform portfolio decisions.
Used in 1 solution
Domain AI agent or copilot
Suggests a TIME disposition (tolerate, invest, migrate or eliminate) for each application, for portfolio owners to decide.
Used in 1 solution
Domain AI agent or copilot
Drafts audit narratives from collected evidence for auditors to review and edit.
Used in 1 solution
Domain AI agent or copilot
Gathers evidence from connected systems for the controls being assessed.
Used in 1 solution
Domain AI agent or copilot
Tracks regulatory updates and highlights those that may affect existing obligations.
Used in 1 solution
Domain AI agent or copilot
Suggests risk scores from connected data, for risk owners to review.
Used in 1 solution
Domain AI agent or copilot
Suggests grouping and priority for security alerts, for analysts to confirm.
Used in 1 solution
Domain AI agent or copilot
Ranks known vulnerabilities by likely exploitability, to help prioritise remediation work.
Used in 1 solution
Domain AI agent or copilot
Assembles related alerts, assets and identities into a view that supports an analyst's investigation.
Used in 1 solution
Domain AI agent or copilot
Relates detections to the MITRE ATT&CK knowledge base as reference context.
Used in 1 solution
Domain AI agent or copilot
Generates disruption scenarios for business-continuity planning and exercises.
Used in 1 solution
Domain AI agent or copilot
Flags when an important service approaches or exceeds its defined impact tolerance.
Used in 1 solution
Domain AI agent or copilot
Suggests a next step for an opportunity or customer, for the account owner to decide.
Used in 1 solution
Domain AI agent or copilot
Drafts replies to customer messages for a person to review before sending.
Used in 1 solution
Domain AI agent or copilot
Helps marketers define audience segments from connected customer data.
Used in 1 solution
Domain AI agent or copilot
Highlights customers showing signs of churn risk, for customer-success teams.
Used in 1 solution
Domain AI agent or copilot
Groups customer feedback into themes and sentiment for review.
Used in 1 solution
Domain AI agent or copilot
Helps finance teams track close tasks and reconciliations; postings stay in the finance system.
Used in 1 solution
Domain AI agent or copilot
Flags unusual journal entries for finance review before close.
Used in 1 solution
Domain AI agent or copilot
Prepares cash-flow forecasts from connected financial data for treasury review.
Used in 1 solution
Domain AI agent or copilot
Extracts key clauses from supplier contracts for procurement and legal review.
Used in 1 solution
Domain AI agent or copilot
Classifies spend lines into categories to support procurement analysis.
Used in 1 solution
Domain AI agent or copilot
Combines connected supplier data into risk indicators for procurement review.
Used in 1 solution
Domain AI agent or copilot
Prepares demand forecasts from connected sales and operations data for planners.
Used in 1 solution
Domain AI agent or copilot
Suggests stock levels and replenishment options for planners to approve.
Used in 1 solution
Domain AI agent or copilot
Suggests delivery routes for dispatch teams to confirm.
Used in 1 solution
Domain AI agent or copilot
Flags unusual changes in overall equipment effectiveness for operations teams.
Used in 1 solution
Domain AI agent or copilot
Highlights recurring quality patterns in production data for quality teams.
Used in 1 solution
Cross-platform
Used in these business solutions
Link modules are composed into these outcome-led iShield solutions — each one combines capabilities across Nexus, Connect, One, Link and GRC.
Explore Link's integration architecture, capabilities and technical patterns to understand how it can support your enterprise integration strategy.
Your privacy choices
We use strictly necessary storage to run this website. With your permission we also use first-party analytics to understand which pages are useful. Analytics stays off unless you choose "Accept all" or turn it on in "Manage". You can change your choice at any time from "Cookie settings" in the footer. See our Privacy Policy.