Ask your plan a question. Get an answer you can audit.
PA Insight Layer is a governed AI layer for IBM Planning Analytics (TM1). It runs entirely in your AWS account, connects to your existing TM1, and answers financial questions with figures that are recalculated against the model before they are shown. Nothing is written to TM1.
What it does
Built for the people IBM's own tooling leaves out: the FP&A analyst and the controller who need to understand the plan, not maintain the model.
Variance analysis with narrative
Actual versus budget versus forecast, decomposed by the drivers in your model (volume, price, mix, FX, unit cost), with a narrative that cites every figure to its cell and the rule that produces it.
Guided drill-down and outliers
Follow a variance down the hierarchy, flag elements that behave abnormally across versions, and see which driver explains the change.
A semantic layer over your model
Cubes, dimensions, hierarchies, rules and processes described in business terms, reviewed by your modeller, versioned, and used by the agent to resolve what a question actually refers to.
Verified figures, or none
Every number in an answer is recalculated with a deterministic MDX query before publication. A figure that does not reconcile is blocked, not softened.
How it works
The agent plane is Amazon Bedrock AgentCore. TM1 is reached through an MCP server that holds one session per user, so TM1's own security is the last line of defence and is never bypassed.
Signs in with your corporate identity provider
Internal web app behind your SSO
Isolated session, policy check on every tool call
Read and analysis tools, one TM1 session per user
On premises, Planning Analytics on Cloud or as a Service
The model proposes; the code disposes. The language model never alters TM1. Tools are read, analysis or sandbox; the only path to a write (a later phase) is a human approval flow where the approver's own credential executes the commit.
Design principles
End-to-end identity
Each call to TM1 runs as the real user, or at minimum as the user's role. Cube, dimension and cell security in TM1 is reused, not reimplemented.
Data stays in your account
Single-tenant deployment, Bedrock reached through VPC endpoints, no internet egress, encryption with keys you manage.
Model-agnostic
The model is a parameter. Each release must pass the evaluation set with at least two model families, and an open-weight option can run inside your account.
Everything observable
Each session is an immutable trace: prompts, tools, results, and the versions of the semantic layer and the model that produced them.
Deployment
Delivered as infrastructure as code (AWS CDK, synthesised to CloudFormation) and deployed into your account by your team or ours.
- Agent planeAmazon Bedrock AgentCore: Runtime, Gateway, Identity, Policy, Memory, Observability and Evaluations
- ModelsClaude on Amazon Bedrock by default; Amazon Nova as second validated family; open-weight models on SageMaker as an option for restricted environments
- Connectivity to TM1Site-to-Site VPN or Direct Connect for on-premises; fixed egress IP for Planning Analytics on Cloud; outbound HTTPS for Planning Analytics as a Service
- IdentityYour IdP over OIDC for users; per-user or per-role TM1 credentials held in the AgentCore Identity vault, released only to that user's session
- Network and encryptionPrivate VPC with no internet gateway, VPC endpoints for every AWS service, customer-managed KMS keys, TLS on every hop including the link to TM1
- AuditSession records with point-in-time recovery and immutable traces under S3 Object Lock, retention configurable for financial environments
Roadmap
Read and analysis: variance and driver analysis, outlier detection, semantic layer, web chat, session audit. This is the scope of the current proof of concept.
What-if scenarios in TM1 sandboxes with cell-by-cell diff, and governed write-back with human approval and full audit.
Structured decision services on TM1 events, an Excel add-in and Teams on the same gateway, access for third-party agents, and the AWS Marketplace listing.
What it does not do
- Generate or modify rules, feeders, TurboIntegrator processes or chores.
- Write to production without an identified human approver whose credential executes the commit.
- Send TM1 data outside your AWS account.
- Replace Planning Analytics' statistical forecasting.
Common questions
Does it replace Planning Analytics or Cubewise tools?
No. It sits beside them. Cubewise serves the developer and the administrator; IBM's own assistant requires Cloud Pak and watsonx. PA Insight Layer serves the business user, in your AWS account, with your choice of model.
Which versions of TM1 are supported?
On-premises v11 and v12, Planning Analytics on Cloud v11 and Planning Analytics as a Service v12, each with the authentication mode that version supports.
Where does the data go?
Nowhere. The deployment is single-tenant in your account, Bedrock is reached through private endpoints, and Bedrock does not retain or train on your data.
How do we start?
With a six-week proof of concept on your own TM1, against a set of financial questions agreed with your team, measured on numerical accuracy, isolation between users, latency and analyst acceptance.
Pilot it on your own TM1.
Six weeks, your account, your model, a go or no-go decision backed by measured results.