AI-powered LeanIX Kehrwoche Automation — Pre-fills quarterly to-do answers, resolves sources automatically, and delivers one-click approval for Product Owners. Agent + Copilot for end-to-end IT portfolio governance.
57 mandatory fields classified into three automation tiers based on data source availability and confidence.
| # | Cluster | Field | Source | Status |
|---|---|---|---|---|
| 1 | Business Architecture | Business Capability & Function | LeanIX | Mapped |
| 2 | Portfolio Strategy | TIME Classification | LeanIX | Derivable |
| 3 | Portfolio Strategy | US Risk Relevant | LeanIX + Hosting | Rule-based |
| 4 | Portfolio Strategy | Cloud Nativity | LeanIX + Infra | Rule-based |
| 5–11 | Security / Info Class | Availability, Confidentiality, Integrity, Personal Data, Validity, Classification Date, Internet Facing | Archer (AGP) | Synced |
| 12–16 | Security / App Protection | App-Confidentiality, App-Integrity, App-Availability | Archer (AGP) | Synced |
| 17–18 | Technology Architecture | Software Acquisition Model, Source Code Location | Git / SCM | Derivable |
| 19 | Technology Architecture | Data Center | Hosting Metadata | Derivable |
| 20–22 | Identity / Access | Application Registration, Client ID, Auth Method | IAM | Synced |
| 23–25 | Organisation | Application Owner, Technical Contact, User Groups | Alice | Synced |
| 26–28 | Technology Architecture | Cloud Provider, Hosting Region, Account ID | Cloud Accounts | Synced |
| # | Cluster | Field | AI Approach |
|---|---|---|---|
| 1 | Information | Category | Classify from description + tags |
| 2 | Information | Application Type | Infer from deployment/usage patterns |
| 3 | Information | Short Name | Generate abbreviation from name |
| 4 | Information | Description | Validate length (≥100 chars), suggest improvements |
| 5 | Information | Lifecycle | Validate date consistency, flag gaps |
| 6 | Portfolio Strategy | Scalability Requirements | Infer from infra + traffic patterns |
| 7 | Portfolio Strategy | Integration Complexity | Count relations/interfaces in LeanIX |
| 8 | Portfolio Strategy | Migration Complexity | Analyze tech stack + dependencies |
| 9 | Regulatory/Legal | GDPR Relevance | Infer from Personal Data flag + data flows |
| 10 | Regulatory/Legal | NIS2 — Digital Infrastructure | Classify from service type |
| 11–13 | Security | Vehicle IT Security (3 fields) | Classify from app domain/description |
| 14 | Specific Attributes | Auth Transformation Analysis | Check AD component mapping |
| # | Cluster | Field | Copilot Support |
|---|---|---|---|
| 1–3 | Organisation | Business / Technical / Consumer Owner Org | Suggest from org tree, human confirms |
| 4–8 | Subscriptions | Responsible, Business Owner, Tech Owner, Contacts | Suggest from existing subscriptions |
| 9 | Regulatory/Legal | Password Requirements (RISE) | Decision tree with policy references |
| 10 | Regulatory/Legal | Access Rights Review | Decision tree with policy references |
| 11 | Regulatory/Legal | Multi-Factor Authentication | Guide through GAS MFA / local options |
| 12 | Regulatory/Legal | Authorization Systems | List approved systems (Alice, GEMS, etc.) |
| 13–15 | Regulatory/Legal | Access Concept, On-/Offboarding, Privileged Accounts | RISE compliance checklist |
| 16–17 | Regulatory/Legal | IAM Data Source, Regular Sync | Guide through provisioning options |
| 18–19 | Regulatory/Legal | Deletion Concept, Type of Deletion | GDPR policy references |
| 20–21 | Regulatory/Legal | EU Digital Service Act, EU Sovereign Infra | DSA framework / US risk guidance |
Three AI-powered components work together to automate the quarterly Kehrwoche cycle end-to-end. The Agent pre-fills answers, the Copilot assists POs interactively, and the Source Resolver auto-maps LeanIX fact sheets to code repositories and documentation.
Resolves sources, gathers evidence, and pre-fills Kehrwoche to-do answers. Rules for 70%, LLM for 30%. Sends bundled email to POs.
Source Resolver
Rules Engine
LLM Answerer
Email Notifier
RAG chatbot for interactive guidance. Explains agent answers, helps POs edit suggestions, and handles Tier 3 fields requiring expert input.
RAG Pipeline
Chat Handler
Field Advisor
Apply Action
Auto-maps LeanIX fact sheets to GitHub repos and Confluence spaces. Priority chain: org custom property → LeanIX field → file scan → fuzzy name match.
GitHub Properties
LeanIX ExternalId
Repo File Scan
Name Matching
Horizontal node-graph showing the Orchestrator Agent, its tools, and decision branches — n8n style
Interactive chatbot flow: PO asks a question, RAG retrieves context from knowledge sources, LLM generates an answer with an Apply action
An agentic AI pipeline where a central Orchestrator Agent delegates tasks to specialized sub-agents, each equipped with tools, memory, and decision loops. Human-in-the-loop approval gates ensure PO oversight.
A layered, provider-agnostic architecture for AI-powered factsheet automation. Swap any component without breaking the stack.
Data flows top-down: API → Business Logic → Providers → External Systems
Each infrastructure concern uses the Abstract Base Class + Factory pattern — swap implementations without changing business logic.
Auto-resolves sources, gathers evidence from 6+ systems, pre-fills Kehrwoche to-do answers, and delivers one-click approval to Product Owners. Zero PO setup, zero maintenance.
The agent auto-resolves which GitHub repo and Confluence space belongs to each LeanIX fact sheet using a priority chain of fallbacks. 95%+ auto-resolved.
leanix_id set as mandatory property at repo creationexternalId or description contains repo URL.leanix.yml, catalog-info.yamlEvidence is fetched in parallel from all available sources for each fact sheet.
Tech stack, Dockerfile, CI config, models, README, Confluence URLs. Read via Org App.
Project roles, release cycles, sprint status, active development signals.
Security classification, availability, confidentiality, integrity ratings.
Existing field values, relations, subscriptions, org structure, fact sheet metadata.
A skill_guide.yaml maps each Kehrwoche question to its data source, answer strategy, and expected format.
Deterministic answers for questions with clear data sources. High confidence, no LLM cost.
Tech stack
Cloud hosting
Release cycles
Owner / team
Security class
Data center
AI-generated answers for ambiguous or context-dependent questions. Evidence-cited, confidence-scored.
GDPR relevance
Data classification
Retirement plan
Architecture fit
Migration strategy
Explains agent-generated answers, helps POs review and edit suggestions, guides Tier 3 fields interactively, and applies changes — all through a conversational interface backed by expanded knowledge sources.
Field descriptions, valid options, hints. Chunked per field/question section.
Field inventory, automation status, source systems. One chunk per row.
Pre-filled answers with evidence citations and confidence scores from the Kehrwoche Agent.
Live context from code repos, project boards, and documentation gathered by the Source Resolver.
Application registration details, client IDs, authentication methods, and identity provider mappings.
User directory details, org contacts, team memberships, and role assignments for PO lookup.
MyApp-12345, hosted on AWS ECS with Lambda, I'd suggest Cloud-Enabled / Hybrid.Step-by-step message flows between components for each major operation.
Agent for automation, Copilot for interactive guidance.
End-to-end Kehrwoche automation: resolves sources, gathers evidence, answers questions, emails POs, and handles one-click approvals.
| Module | Purpose |
|---|---|
source_resolver.py | Auto-map fact sheets to GitHub repos + Confluence spaces |
evidence_gatherer.py | Parallel fetch from GitHub, Jira, Confluence, Archer |
rule_engine.py | Deterministic answers for ~70% of questions |
llm_answerer.py | LLM-generated answers for ~30% ambiguous questions |
email_service.py | Bundle answers per PO, send via SMTP with approve link |
approval_handler.py | HMAC validation, LeanIX write-back, to-do completion |
skill_guide.yaml | Maps each question to source, strategy, and format |
Interactive assistant for reviewing agent answers, editing suggestions, explaining policies, and guiding Tier 3 fields with multi-turn conversations.
| Module | Purpose |
|---|---|
knowledge_base.py | PDF/Excel/metadata + agent results + policy docs ingestion |
chat_handler.py | Multi-turn conversation + intent classification |
field_advisor.py | Decision trees + policy references (RISE, GDPR, NIS2) |
FastAPI-powered REST API with OpenAPI docs at /docs.
| Method | Endpoint | Description |
|---|---|---|
| POST | /api/v1/agent/run | Trigger Kehrwoche processing (all open to-dos) |
| GET | /api/v1/agent/drafts/{po_email} | Get pre-filled draft answers for a PO |
| GET | /api/v1/agent/status | Current run status (pending, processing, done) |
| GET | /approve/{token} | Lambda Function URL — one-click approval endpoint |
| Method | Endpoint | Description |
|---|---|---|
| POST | /api/v1/agent/validate/{fs_id} | Validate a factsheet against all mandatory field rules |
| POST | /api/v1/agent/auto-populate/{fs_id} | Auto-populate Tier 1 fields (dry-run by default) |
| POST | /api/v1/agent/suggest/{fs_id} | Generate AI suggestions for Tier 2 fields |
| POST | /api/v1/agent/batch | Batch process multiple factsheets |
| Method | Endpoint | Description |
|---|---|---|
| POST | /api/v1/copilot/chat | Send a message and get an AI response |
| POST | /api/v1/copilot/apply | Apply a chat-suggested value to LeanIX |
| GET | /api/v1/copilot/session/{session_id} | Get conversation history |
| Method | Endpoint | Description |
|---|---|---|
| GET | /api/v1/reports/quality | Portfolio-wide quality report |
| GET | /api/v1/reports/gaps/{org_id} | Gap report for a specific organization |
| GET | /api/v1/reports/factsheet/{fs_id} | Detailed quality report for one factsheet |
| Method | Endpoint | Description |
|---|---|---|
| GET | /api/v1/health | Health check with dependency status |
| GET | /api/v1/audit/{fs_id} | Audit trail for a factsheet |
| GET | /api/v1/audit/ | All audit entries |
Production on AWS with EventBridge scheduling, Lambda Function URL for approvals, DynamoDB for draft storage, and MB Nexus Model Garden for LLM.
docker compose -f docker-compose.yml -f docker-compose.nexus.yml up
Measurable improvements across time, quality, and cycle duration.
Enterprise-grade security with EU data residency and audit trail.
LeanIX API token exchange. Mercedes-Benz SSO integration planned.
MB Nexus Model Garden (GPT-5.2 / Claude Opus 4.6) hosted within MB infrastructure (EU compliant).
User emails and names stripped before LLM context injection.
Every write operation logged with before/after values, confidence scores, and source.
.env for dev; AWS Secrets Manager for production with key rotation.
One-click approve URLs are HMAC-SHA256 signed with expiry, PO email binding, and one-time-use token.
All field auto-populate operations default to dry_run=True. Preview before writing.
Strict layered architecture — imports flow downward only.
| Rule | Allowed | Forbidden |
|---|---|---|
| R1 | api/routes/ → agent/, copilot/, core/ | agent/ → api/routes/ |
| R2 | agent/ → providers, core/ | agent/ → copilot/ |
| R3 | copilot/ → providers, core/ | copilot/ → agent/ |
| R4 | Providers → core/ only | Providers cross-importing |
| R5 | core/ → stdlib, third-party | core/ → any app module |
LeanIX GraphQL client, knowledge base from User Guide + Excel, field validation, first quality report
Rule engine for Tier 1, Archer/Git data fetchers, GraphQL mutations, audit trail, dry-run, batch processing
RAG pipeline, chat handler, Tier 2 suggestions, context injection, Streamlit UI, "Apply" action
Source resolver (GitHub custom props, LeanIX ExternalId), multi-source evidence gathering (GitHub, Jira, Confluence), skill guide, rules + LLM answering, email-based approval with HMAC-signed links
Copilot integration with agent results, dashboard with quality scores, reminder/escalation engine, performance optimization
AWS deployment (EventBridge, Lambda URL, DynamoDB, ECS, OpenSearch), MB SSO, SMTP relay, load testing, UAT