---
title: "BI Implementation"
slug: bi-implementation
section: Integrations
status: stable
description: "The implementation companion to Reporting & Analytics — how business intelligence is actually served today."
last-updated: 2026-10-07
---

# BI Implementation

The implementation companion to Reporting & Analytics — how business intelligence is actually served today. Verified against both repos 2026-07-04.

## Status — No Warehouse, Two Live Surfaces

> **There is no dedicated BI product or data warehouse**
>
> No Metabase/Looker/Power BI, no dbt, no BigQuery mart exists in either repo. The original draft's framing (chosen BI tool, warehouse/mart schema, seat licensing, a BI access model distinct from Globus RBAC) describes decisions that were never taken. What runs today: (1) six k-anonymous MCP BI tools for agents/automation, and (2) in-app report endpoints reading the operational Postgres directly, gated by ordinary Globus RBAC. Scheduled rollups ride n8n and the background workers on Batch Jobs.

## Surface 1 — MCP BI Tools (k-anonymous)

Six live tools, documented in full on Ecosystem MCP BI Tools : getEcosystemHealth, getExceptions, getPipelineSummary, aggregateQuery, query_globus_data (entities: applicants, hosts, placements, with dimensions + filters), and getBusinessQueue. Privacy contract: k-anonymity with minGroupSize = 5 — aggregate-only output, no per-person rows, and the count of suppressed groups is returned so consumers know what was hidden. Pipeline summaries are also published/consumed over MCP (ecosystem_get_pipeline_summary / publish_pipeline_summary; schema includes by_stage, by_program, by_visa_type, placements, matches, reservations).

## Surface 2 — Globus Report Endpoints

| Endpoint | Permission | Purpose |
| --- | --- | --- |
| GET /api/reports/pipeline | reporting.view | Pipeline report |
| GET /api/reports/queue-metrics | reporting.view | Queue metrics |
| GET /api/reports/step-analytics (+ /stuck-applicants) | reporting.view | Step analytics and stuck-applicant detection |
| GET /api/reports/checkin-compliance (+ /overdue) | compliance.checkin.view | Check-in compliance and overdue lists |
| GET /api/admin/data-export | system_settings.manage | Raw data export |

All of these live in server/routes/reports.ts and additionally pass requireScopeAccess (brand isolation). They query the operational Postgres directly — there is no separate analytical store to drift out of sync.

## Access Model

Contrary to the original draft, there is no BI access model distinct from Globus RBAC: report endpoints reuse the standard permissions above plus scope enforcement, and the MCP tools substitute k-anonymity for row-level ACLs. PII stance for analytics: aggregate-only through MCP; raw exports are locked behind system_settings.manage — see PII & Data Handling.

## Open Decisions (true target-state)

Still genuinely undecided, and only worth deciding when the operational-Postgres pattern stops scaling: whether to adopt a dedicated BI tool and warehouse (with a mart schema mirrored from Globus stores), embedded vs standalone dashboards, scheduled report delivery beyond the current n8n paths, and the cost model for any of that. Until then, this page plus Reporting & Analytics (the architectural spec: dashboard catalog, KPI definitions, data-flow model) are the complete BI story.