Anaplan AI Gateway puts workspace permissions in focus

Anaplan AI Gateway connects external LLMs, assistants and agents, including Claude, Gemini and Microsoft Copilot, to Anaplan models through a governed Model Context Protocol interface. Users can query planning data in natural language, with write access described as coming soon. Availability depends on license edition and must be requested through a Customer Success Business Partner.

Enablement applies to entire workspaces, not individual apps. Any online model a user can access in an enabled workspace can be queried, even if its data has never appeared in a published app or page. Existing Anaplan permissions govern requests, making model-level access controls the security boundary. Workspace administrators can also query offline models, while archived models are inaccessible through Gateway.

Preparation centers on auditing model inventories, archiving unused models, reviewing data permissions, relocating models where appropriate, validating moved models and checking user access. Model roles, Selective Access and Dynamic Cell Access need scrutiny. Sensitive models that cannot be adequately restricted should move to workspaces without Gateway enabled, while development, testing and production environments should remain separated.

Relocation creates new workspace and model identifiers, requiring checks of integrations, apps, reports and other dependencies before switching over. New users should start with No Access and without administrator privileges, with permissions granted deliberately. Recurring reviews should accompany releases and changes to models, workspaces or user groups.