> ## Site index
> Fetch the complete index of this site at: https://www.tharamcp.com/llms.txt
> Use it to discover every available page before exploring further.

# How It Works — Three-Layer Read-Only MCP Architecture | Thara

URL: https://www.tharamcp.com/en/how-it-works

How Thara connects legacy systems to AI: three-layer architecture, structured deployment milestones, role-based access control, comprehensive audit trails, and PDPA compliance.

Connect Your Business Systems to AI

Securely and Within Governed Scopes

Architecture, Access Governance, and Data Security

Thara uses the Model Context Protocol (MCP) to provide a read-only governance and integration bridge between your business data and AI assistants. Supports direct database, mirror DB, and batch sync without modifying legacy software.

## How the pieces fit together

Three layers, none of which replace what you already run.

### Your existing systems

ERP, accounting, POS, PMS, HR, procurement, inventory, or anything custom-built — unchanged, running exactly as they do today. No upgrades, no downtime, no retraining your staff. If it has a database, an API, or can export a file — we can connect it.

### Thara's read-only MCP layer

Per-system generated tools, role-based access control, and a full audit log — nothing writes back to your source systems. Think of it as a one-way mirror: AI sees only what's permitted, with no path to write anything back.

### Your AI assistant

Claude, ChatGPT, Gemini, or a self-hosted model — bring your own, switch anytime, no lock-in.

## Project Implementation Milestones

A structured, milestone-based implementation delivered against verified system readiness.

### Discovery & Exploration

Milestone 1

Explore systems, map data structures, and execute an NDA before sharing confidential project details.

### Connect & Mapping

Milestone 2

Build read-only MCP connectors and map data fields via Direct DB, Mirror DB, or Batch sync pipelines.

### Security & Governance

Milestone 3

Apply Role-Based Access Control (RBAC), configure endpoint-level PII masking, and enable audit logging.

### UAT & Golden Handover

Milestone 4

Jointly validate data accuracy with your team, complete handover docs, and enter the Golden Period.

## Safety & Governance

### Read-Only Guarantee

No MCP tool Thara generates can ever write, update, or delete data in a source system.

### Role-Based Access Control

Every tool is gated by role — staff, managers, and owners see only the tools their role permits.

### Security Audit Trail

Tool-call records support security and accountability. Customer-visible detail, audit exports and retention depend on the agreed plan — not unrestricted recording of conversations or raw results.

### Per-Tenant Isolation

Each business's data stays in its own isolated tenant — no cross-business mixing, ever.

### PII Protection (PDPA-Aligned)

Fields that qualify as personal data — phone numbers, emails, ID numbers — or any sensitive operational fields specified by the customer can be configured for automated masking or tokenization before they ever reach the AI. PDPA alignment is built into the tool layer itself, customizable per organization, not just written into a policy document.

## One console to see and control every user

The management console is already built — not a future roadmap item.

### People & Access

Invite, manage, and revoke every user's access to Thara from a single console — no per-system account juggling.

### Tool Usage Visibility

See exactly which MCP tools each person called, when, and how often — full accountability, not a black box.

### Per-User Tool Control

Turn individual MCP tools on or off for any user instantly — the finest-grained access control available.

## Supported Systems

- ERP
- Accounting
- POS
- PMS
- HR
- Procurement
- Inventory
- Golf
- GL
- CRM
- Reservations
- Kitchen / F&B
- And more

## Ai Providers

- Claude
- ChatGPT
- Gemini
- Self-hosted / local models