OneStream vs Pigment (2026)

More than 250 no code and direct connectors and REST APIs load ERP, CRM and other data, from SAP, Oracle and Workday among others, with validations before and after each load, and a Snowflake connector serves analytics. SensibleAI Agents work on what lands in OneStream and inside Microsoft 365. Their actions stay in OneStream's own cube and workflows, and outside systems are reached by the assistants a team connects, not by the agents.

Sourceonestream.com/platformread 2026-10-13

Data reaches the model through scheduled imports from ERP, CRM, HR, data warehouse, BI, spreadsheet and file storage sources, and the agents work on that model instead of inside the source systems. Agent connectors reach outward to Notion and Slack. An admin switches a connector on, each member signs in with their own account, and each read, write or delete tool is set to always allow, needs approval or blocked. Google Drive is still to come, and a team cannot add an MCP server of its own, so agent action outside Pigment stops at those two products.

Sourcekb.pigment.com/docs/set-up-agent-connectorsread 2026-10-13

Finance Analyst schedules several long running workflows in parallel and works a variance question through multistep, driver based flux analysis on OneStream's close, planning and reporting engines. Those engines carry the close and planning workflows themselves, with their approvals and period locks. The Agentic Finance Toolkit adds orchestration and skills that guide how outside agents work through OneStream data and workflows.

Sourceonestream.com/solutions/ai-agentic-financeread 2026-10-13

In Plan & Build mode the Modeler Agent gathers context, writes a structured action plan and then carries it out across Dimensions, Lists, Metrics, formulas and data imports, asking before it switches to another mode. The Analyst Agent takes a Mission, a task written in plain language, and works through its subtasks.

It sources the data, drills into the drivers, runs its own code against the model's metrics and assembles a report of text and charts. A user can leave an agent working and come back to an unread badge on the chats that have answered. Custom Agents draw on the same analysis and documentation skills, though they cannot schedule Missions.

Sourcekb.pigment.com/docs/configure-and-run-the-modeler-agentread 2026-10-13

Variance analysis runs on a schedule as well as on demand, and Finance Analyst can queue long running workflows to run on their own. People reach the agents in OneStream, Excel and Teams, and through the Finance Agentic Layer a question or a workflow can start from Copilot, Claude, ChatGPT or Gemini instead.

Sourceonestream.com/solutions/airead 2026-10-13

Saving an Analyst report as a Mission makes it repeatable, and switching on Scheduling sets a start time and a cadence for later runs, with each run's output kept in the report or exported to a text Metric. The Missions tab shows every saved Mission with its run frequency. People also start the agents from the AI sidebar on any Board, from the AI Analysis button beside a Metric, Table or numeric Widget, and from a prompt typed at the top of the Workspace homepage.

Sourcekb.pigment.com/docs/configure-and-run-the-conversational-analyst-agentread 2026-10-13

Finance Analyst queries the OneStream cube directly, using the same hierarchies, business rules and finality the close and planning engines use. Search Agent combines enterprise retrieval with finance context over policies, procedures, platform guides and custom notes, citing where each answer came from. Deep Analysis works across thousands of contracts, policy bundles and compliance archives to answer complex questions.

Sourceonestream.com/solutions/ai-agentic-financeread 2026-10-13

Answers come from the customer's live planning model, its Applications, Blocks, Metrics and Boards, and an admin can switch AI data access off on any Block that should stay out of reach. The Analyst prepares itself once per Application on the first question, a setup that takes longer the more Blocks there are.

Custom Agents carry standing knowledge a team supplies, such as process documents, glossaries, FAQs, guidelines and chosen Boards and Metrics, and users can attach spreadsheets, text and images to a chat. When a security admin allows it, the agents also search the web, optionally only on approved domains, and look inside the model first when the answer may be there.

Sourcekb.pigment.com/docs/create-custom-agentsread 2026-10-13

Finance Analyst holds a conversation over several turns, and a change of persona, which sets the cubes and defaults it works from, takes effect in the next new conversation. Administrators write company and persona business context, rules the agent reads on every question, and analysis plans keep a version history of every edit. No memory carries what a team said in one conversation into later ones, so a team's conventions belong in that business context. Every turn of every conversation stays visible to administrators in the AI Control Tower's Chat Explorer as a record for review.

Sourcedocumentation.onestream.com/docs/content/saia/fan/fan-end-user-behavior.htmlread 2026-10-13

Each member keeps a private chat history with the agents, where chats can be pinned, filtered by Application and reopened to carry on from where they stopped. The Modeler remembers which mode was last used in each chat, and a saved Mission keeps an analysis so it can run again. A team that wants an agent to hold on to its conventions writes them into a Custom Agent's instructions, since chats do not build up a memory of their own.

Sourcekb.pigment.com/docs/pigment-agentsread 2026-10-13

The agents work inside OneStream's role based access, approvals, period locks and audit trails, so a closed period stays closed to them as it does to people. Accountants review an agent's investigation, sources and evidence before they answer or act. A step where OneStream holds an agent's own change or workflow start for someone's approval is not part of what the agents offer today.

Sourceonestream.com/cmp/sensible-ai-agents-for-accountingread 2026-10-13

In Plan & Build mode the Modeler Agent puts its action plan up for validation and waits for a go ahead at each waypoint as it works. Auto accept lets it continue without stopping, except for deletions, which a person confirms every time.

Its changes to the model are permanent and attributed in Application History to the member who ran it, and Ask mode answers without touching anything.

Connector tools set to needs approval make the agent propose a create, edit or delete in Notion or Slack and wait for the member to confirm it, and a web search that might reveal sensitive data asks for approval first.

Sourcekb.pigment.com/docs/configure-and-run-the-modeler-agentread 2026-10-13

Every agent and every MCP interaction runs under the user's OneStream identity and existing role based permissions, so an assistant connected through the Finance Agentic Layer sees only the data that user may see. OneStream holds SOC 1 Type II and SOC 2 Type II reports, ISO 27001:2022 certification, FedRAMP Rev. 5 High authorization and TX-RAMP, with a DORA compliance statement and a CSA STAR questionnaire in its trust center.

Sourcetrust.onestream.comread 2026-10-13

Sign in runs through SAML 2.0 single sign on with SCIM provisioning for Okta, Microsoft Entra ID or any compliant identity provider, or through Google Login, with multifactor authentication and domain allowlisting on top.

Group based roles and fine grained data access rights decide who can see and change each piece of data, and the agents, Custom Agents and MCP sessions act only within the rights of the member using them, under separate permissions to use agents and to configure them. Pigment holds ISO 27001 certification and SOC 1 Type 2 and SOC 2 Type 2 reports, audited every year, offers a SOC 3 report, sits at CSA STAR level one and covers GDPR and CCPA.

An independent penetration test summary was refreshed in June 2026, and API keys created since May 2026 follow a structured format that secret scanning tools can catch.

Sourcepigment.com/securityread 2026-10-13

Each agent query and workflow execution is audited, with the sources, supporting evidence and history an auditor needs to see how a result was produced. The AI Control Tower's Chat Explorer logs every turn of every conversation with the full question, the response and its review details, and its audit logs capture each sensitive action with the user, the entity touched and its state before and after the change. Analytics and credit history break usage down by user and by agent, and administrators can see activity from assistants connected through the Finance Agentic Layer inside OneStream.

Sourcedocumentation.onestream.com/docs/content/saia/act/chat%20explorer.htmlread 2026-10-13

The Missions tab shows every Mission the agents have run, and each change the Modeler makes is recorded in Application History against the member who ran it, inside edit histories that go down to the block level. Agent outputs explain how they were reached, with the data and logic behind them, and the Modeler writes up each change as it goes. The Audit Trail API sends login, administration, security and application events to a SIEM, and admins follow AI credit use in near real time on the Plan & Usage and AI credits screens.

Sourcekb.pigment.com/docs/pigment-agentsread 2026-10-13

OneStream runs on Microsoft Azure, hosted in the United States for the Americas, in the European Economic Area and the UK for Europe, and in Australia for Asia Pacific, unless a contract sets otherwise. SensibleAI prompts are processed in Canada, the EEA or the UK for customers there. A FedRAMP High authorized cloud serves government agencies. How a customer picks among the regions is a contract matter.

Sourcetrust.onestream.comread 2026-10-13

Customer data is stored in the region the customer picks, Frankfurt in Germany or Oregon in the United States, on Google Cloud across three independent zones, with backups in multiregional buckets inside the same geography. Buyers who need French or European sovereign hosting can run Pigment on S3NS PREMI3NS, a SecNumCloud 3.2 qualified cloud operated by a Thales subsidiary and shielded from jurisdiction outside Europe. Disaster recovery is rehearsed live once a year against a six hour recovery time and a 24 hour recovery point.

Sourcepigment.com/securityread 2026-10-13

Four prebuilt SensibleAI Agents each do their own job. Finance Analyst handles cube analysis, Search Agent answers from policies and guides, Deep Analysis reads large document sets and Forecast Agent explains SensibleAI Forecast results. Genesis adds a live library of blocks, dashboards, KPIs, workflows, models and AI summarization that teams snap together into new processes, and SensibleAI Account Reconciliations ships prebuilt detectors for the close.

Sourceonestream.com/solutions/ai-agentic-financeread 2026-10-13

The Modeler, Analyst and Documentation Agents come ready to switch on for each Application, and each does its own job. The Modeler builds and maintains models, the Analyst analyzes and reports, and the Documentation Agent answers platform questions from Pigment's knowledge base. Custom Agents come with worked examples for user guidance and for FP&A, workforce and supply chain analysis, and the chat offers a library of suggested prompts. The Analyst comes with ready use cases by role, from monthly expense variance and EBITDA and cash checks to ARR cohorts, hiring gaps and supplier risk.

Sourcekb.pigment.com/docs/pigment-agentsread 2026-10-13

SensibleAI prompts go to models available through Microsoft Foundry, which OneStream chooses, and calculations stay on OneStream's own deterministic finance engines. No setting lets a customer pick the model behind an agent. A team that prefers its own assistant can work in Copilot, Claude, ChatGPT or Gemini through the Finance Agentic Layer, while the SensibleAI Agents stay on OneStream's selection.

Sourcetrust.onestream.comread 2026-10-13

The agents run on pretrained models from AI vendors under enterprise agreements with zero data retention, and customer data is never used to train them. Which vendors and models sit behind the agents is not public, and an admin has no setting to pick or switch the model. Claude, ChatGPT or Mistral can reach Pigment through its MCP server, which puts a team's own assistant in front of Pigment data while Pigment's agents stay on Pigment's choice.

Sourcekb.pigment.com/docs/ai-faqread 2026-10-13

REST APIs connect outside systems to the platform, and Developer Studio turns OneStream business rules and workspace assemblies into .NET projects that developers edit in VS Code, Cursor or JetBrains Rider and sync back through Git, Azure DevOps or SVN. The Agentic Finance Toolkit adds MCP finance tools and a semantic layer for outside agents, though the MCP address and tool list are not public.

Sourceonestream.com/news/onestream-launches-ai-assisted-developer-studio-and-agentic-finance-toolkitread 2026-10-13

The public REST API, with a Swagger reference, imports data, exports Metric, Table and List data, returns import configurations and starts data flows, under API keys that carry their owner's access rights, IP allow lists and set rate limits, beside an Audit Logs API.

The Pigment MCP server gives each Workspace its own endpoint and signs people in with their Pigment accounts. Its default tools read and analyze, and advanced mode adds tools that create Applications, build Dimensions, Metrics and Tables, write formulas, design Views and Boards and enter data. Pigment keeps Skills files and plugins for Claude Code and Cursor in a public repository.

Sourcekb.pigment.com/docs/supported-toolsread 2026-10-13

The AI Control Tower's Evaluations page tests configured agents against a reusable setup. Each configuration names the agent, Finance Analyst, Search or Deep Analysis, with its persona and a fixed time period or its clusters and plan, sets how many repetitions to run and supplies an input dataset with expected outputs.

Each run shows the input, the expected output and the agent's actual response, and where the LLM Judge is used, a score with an explanation of which elements were right or wrong, so a team can track an agent's quality over time and its consistency across repeated runs. SensibleAI Forecast and SensibleAI Studio measure forecasting models separately, and Forecast Agent explains that accuracy in plain language.

Sourcedocumentation.onestream.com/docs/content/saia/act/ai%20platform%20connections.htmlread 2026-10-13

A builder previews a Custom Agent and refines it before switching it on for members. Test & Deploy environments stage model changes, the Modeler's included, before they reach a production Application that can be locked, and in managed Applications the Modeler works in Ask mode only. Every answer can be traced to its data and logic. Nothing scores the agents' answers against a test set before rollout.

Sourcekb.pigment.com/docs/create-custom-agentsread 2026-10-13

SensibleAI Agents work on OneStream's own engines, data and document stores and inside Microsoft 365, and outside assistants come in through MCP. No agent drives a browser or desktop application to reach another system.

Sourceonestream.com/solutions/ai-agentic-financeread 2026-10-13

The agents act inside Pigment's own model and reach Notion and Slack through connectors. Web search returns information to them, and none of them opens a browser, drives another application's screen or works a desktop session for a user.

Sourcekb.pigment.com/docs/pigment-agentsread 2026-10-13