Suggestions are not identity assertions
Candidate generation runs on the authorized inventory snapshot. It makes no provider calls, LLM requests or embedding comparisons. The engine does not produce a confidence percentage. A matching technical reference means the providers reported compatible values; a reviewer still checks their identity namespace and business meaning.
Current deterministic signals
| Signal | Required boundary |
|---|---|
| Entra agent reference | Selected Copilot entraAgentId and Microsoft 365 agentIdentityId must be valid reference UUIDs in the same configured directory tenant UUID. App IDs, blueprint IDs and owner IDs are excluded. |
| Google resource | An identical full projects/.../locations/.../agents/... or reasoningEngines/... path from a native Google connector. Different path families are not equated. |
| AWS resource | An identical complete ARN from a supported native agent connector; short IDs are not global identity. |
| Exact normalized source name | Unicode NFKC, case-folding, punctuation and whitespace normalization. This is a review clue only. |
What never establishes a link
- A common model, endpoint, tool, owner, directory application or descriptive sentence.
- Equal short vendor IDs under different accounts or projects.
- A new source ID with a familiar display name.
- Seeded data compared with non-seeded evidence.
- A graph connection interpreted as an observed runtime call.
Candidate limits
Each snapshot examines at most 10,000 combinations and displays at most 100 pairs. Explicit reference buckets are evaluated before ordinary name buckets. A limit notice means the visible suggestions are incomplete; it does not mean there are no more matches. Saved decision history remains inspectable. Inventory materialization and saved history are not paginated by this mechanism.
Changed identifiers in one connection
A same-name missing/stale old identity and a new identity may appear as an ambiguity. Continuity is not assumed. Preserve the old evidence, confirm the provider’s identity contract, and use the deliberate manual workflow when guided linking cannot establish current evidence.