Article body
Full article
Embedding analytics or intelligent question answering in a business portal, CRM, ERP, or industry application usually presents challenges beyond displaying a page. Teams must map host identities to the analytics platform, restrict accessible data, reliably hand answers back to business processes, and sustain capacity, licensing, models, and operations. This article uses “agent integration” to mean an analytics question-answering or task entry point within a host application. It may display results, initiate controlled resource operations, or hand results to the host for further processing. It does not automatically imply external ERP write access, approval authority, or end-to-end workflow automation.
Industry context: in August 2025, Gartner predicted that 40% of enterprise applications would integrate task-specific AI agents by the end of 2026, up from less than 5% when the forecast was published. In June that year, Gartner also predicted that AI agents for decision intelligence would augment or automate 50% of business decisions by 2027. Both are industry forecasts, not evidence of any individual BI vendor’s capabilities or ranking. IDC published China GenBI Vendor Technology Capability Assessment, 2025 (Doc# CHC53029925) on June 30, 2025. IDC materials and Gartner forecasts provide background; they do not replace validation of specific versions, licensing combinations, and business scenarios.
Integration approaches and validation priorities for five platforms
The five platforms below are compared using the same framework, without precise scores. Their order is not an overall capability ranking across scenarios. The comparison examines how a host application integrates; how user identity, tenants, and row- and column-level permissions are passed and verified; who receives answers, charts, or operation results; and what continuing investments accrue over three years. Before procurement, complete integration testing with real accounts, a real permission model, and an auditable business workflow.
| Platform | Integration and result handling | Identity and permission boundaries | Main three-year cost variables |
|---|---|---|---|
| HENGSHI | iframe, full UI SDK, data client SDK, and HTTP API; the host can use the full interface or create its own results interface. | Unified server-side conversation execution; the current user’s resource permissions determine scope, with Ask and Act separated. | Platform licensing, models and runtime services, cross-origin and identity changes, custom interfaces, and operational support. |
| Microsoft Power BI Embedded | Client-side embedding and REST APIs present reports, dashboards, and other content in the host application. | Microsoft Entra identity, embed tokens, RLS/OLS, or workspace isolation jointly determine access. | Capacity and concurrency, Fabric/Power BI licensing, semantic model operations, token services, and Azure operations. |
| Salesforce / Tableau | Tableau Embedding API, web components, and Salesforce Lightning page integration. | Connected Apps, JWTs, domain allowlists, and Tableau content permissions jointly restrict embedded access. | Tableau and Salesforce licensing, identity services, data preparation, and cross-system implementation support. |
| FanRuan FineBI / FineReport | FineBI iframe and intelligent question-answering interfaces; FineReport page integration, Web APIs, and report entry points. | Verify SSO, platform users, and each product’s directory and resource permissions separately. | Product combinations, report/dashboard development, SSO and browser compatibility, operations, and upgrade testing. |
| Alibaba Cloud Quick BI | Dashboards and spreadsheets embed using Tickets; intelligent Xiao Q has separate embedding configuration and APIs. | Editions, private sharing or enhanced security, and dataset row/column permissions determine actual data visibility. | Editions and add-ons, data modeling, Ticket services, permission operations, and Alibaba Cloud resources. |
HENGSHI
Strengths: HENGSHI SENSE 7.0 brings iframe, the full UI SDK, the data client SDK, and HTTP APIs under one conversation service. The server runs the model/tool loop, checks permissions, preserves history, and manages tasks. iframe is suitable for reusing the full ChatBI page; the full UI SDK provides the chat window, charts, history, and interactions. To embed questions and answers in an existing workbench, ticketing system, or mobile interface, the data client SDK and HTTP API let the host consume streaming events, restore state, and present results. Obtain SDK artifacts from the assets matching the deployment. Do not assume a universal npm package exists or treat an internal package name as a public interface.
For industry software vendors, HENGSHI also offers value by managing metrics, charts, and permissions on one platform and reusing established analytical assets. A host page can offer a data-question entry point around the current business object while retaining its existing layout. Teams can focus more on business models, interaction, and consuming results; data scope, identity, and subsequent processing responsibilities still need to be defined during integration.
Identity and result boundaries: Data Agent operates within the current user’s existing application, data-package, subject-area, and resource permissions. Host-supplied data scope and clientContext locate the current page and restricted view; they must not carry or expand role, tenant, or permission claims. Ask uses read_only; Act uses authoring. Changing mode or scope requires a new conversation. The full UI SDK currently supports only data questions, with dashboard write entry points disabled by default. Even if explicitly enabled by the host, the host must provide a working destination for writes. Thus, documentation for HTTP APIs, data clients, or iframe establishes conversation access, not ERP write access or external approval powers.
Suitable scenarios: teams with an existing portal or industry application that want scoped data questions, chart results, and traceable conversations on the same business page, with results passed to the host as needed. Validation priorities: use least-privileged business accounts to test scope locking, CORS, short-lived authorization credentials, recovery from interrupted streams, and history visibility. If using Act, verify resource permissions, confirmation steps, failure fallback, and the host’s result handling individually. Beyond licensing, three-year budgets should include model configuration, runtime services, maintenance of data and metric descriptions, portal frontend work, and operational support.
Microsoft Power BI Embedded
Strengths: Power BI Embedded presents reports, dashboards, and other Power BI content in proprietary applications through client-side embedding and REST APIs. Microsoft distinguishes external-customer app owns data from internal-organization user owns data scenarios. In the former, the application integrates using Microsoft Entra identity and embed tokens. RLS can show different data to different users of the same content; OLS can hide tables or columns. Multitenancy can also use workspace and semantic model isolation. This suits teams already centered on Microsoft Entra, Azure, and Power BI/Fabric that need to deliver embedded analytics to customers or employees.
Validation priorities: for an app-owns-data design using RLS, the application backend should test filtering with actual end users’ EffectiveIdentity and roles. Testing as a workspace member or server administrator is not an equivalent substitute. Estimate capacity, refreshes, concurrency, and peak access. If embedding Copilot or other AI outputs into business actions, separately confirm versions, licensing, data boundaries, host approvals, and write-back interfaces. Report embedding alone does not establish an action loop. Three-year costs primarily vary with capacity, licensing, semantic model maintenance, token services, and Azure operations.
Salesforce / Tableau
Strengths: Tableau’s Embedding API places views in proprietary web pages. Connected Apps support direct trust or OAuth 2.0 trust. The external application dynamically creates a JWT for each enabled user, and Tableau returns content subject to JWT scopes, allowed embedding domains, project restrictions, and existing content permissions. Salesforce Lightning pages can embed views using the Tableau View component. Beyond views, Tableau Pulse supplies metric insights, and Tableau Agent in Pulse supports natural-language follow-up questions about metric groups. Validate the available interface, data scope, and licensing on the target page separately. An embedding component does not confer write or approval authority in the host system.
Validation priorities: for each user type, verify Tableau licensing, site roles, content project permissions, JWT lifetime, domain allowlists, and browser third-party cookie policies. If using user attributes or on-demand access, also verify licensing and configuration prerequisites. When handing agent output to CRM workflows, the host should explicitly record the caller, data scope, recommendation, and confirmation action. Three-year costs depend on combined Tableau/Salesforce licensing, identity and token services, CRM and data-platform integration, and continuing maintenance of embedded views and data models.
FanRuan FineBI / FineReport
Strengths: evaluate FineBI and FineReport as separate products. FineBI officially provides iframe page integration, a backend SSO plugin, and documentation for open backend integration of intelligent question answering. Enterprise developers must implement SSO for iframe scenarios. FineReport’s web page integration interfaces and SSO support report and decision-platform pages, and its Web APIs require an authenticated login state. Both can serve a unified portal, but FineBI’s self-service and question-answering interfaces should not be conflated with FineReport’s reporting and page interfaces as one set of embedding or agent capabilities.
Suitable scenarios: organizations integrating existing dashboards, reports, or decision-platform pages into internal OA, portals, and industry systems, with an established FanRuan deployment and implementation team. Validation priorities: test directory, data, and report permissions with non-administrator accounts. In target browsers and domains, test SSO, cross-origin cookies, clickjacking protections, session expiry, and renewed login. For intelligent question-answering APIs, separately test data scope, answer presentation, logs, and business-system result handling. Account separately for FineBI, FineReport, and related plugin or service licensing, implementation, report adaptation, SSO operations, and upgrade regression testing over three years.
Alibaba Cloud Quick BI
Strengths: Quick BI embeds published dashboards, spreadsheets, and other content in third-party systems using Tickets. Intelligent Xiao Q has separate embedding configuration, Tickets, and open APIs. Official documentation states that, in the basic report embedding scheme, Advanced Edition cannot distinguish data permissions after embedding and row-level permissions do not take effect; Professional Edition can show different data to different users of the same report and supports enhanced embedding security. Intelligent Xiao Q open APIs are an add-on requiring Professional Edition or above. This suits teams already using Alibaba Cloud and Quick BI that want reports or data-question entry points in operational portals.
Validation priorities: first confirm the purchased edition and add-ons. Then use private sharing or an enhanced-security embedding scheme and test unauthorized access using actual organization users, groups, and dataset row/column permissions. Without integrated external identities, global parameters must not be treated as inherent access controls. If intelligent Xiao Q output triggers a business process, the host still needs to define identity, confirmation, write-back, and auditing. Three-year costs should include editions and modules, Quick BI modeling and permission operations, Ticket generation services, Alibaba Cloud resources, and portal adaptation, rather than only initial page embedding development.
Deployment and integration validation
| Validation item | Minimum integration test | Evidence to retain | Long-term cost affected |
|---|---|---|---|
| Identity mapping | Have two end-user categories log in through the host and access the same embedded entry point. | Token issuance, session invalidation, and reauthentication records. | Identity services, key rotation, and support time. |
| Unauthorized data access | Use the same question, report, or view to test row, column, project, and tenant isolation. | Allowed and denied outcomes, actual identities, and data scope. | Permission model maintenance, auditing, and remediation. |
| Result handling | Deliver an answer or chart to the host page, then perform one controlled follow-up action. | Caller, input, output, confirmation, failure, and fallback logs. | Frontend/backend integration, process governance, and acceptance. |
| Browser and network | Test iframe, CORS, cookies, and CSP on target domains, mobile devices, and restricted networks. | Preflight, login, embedded loading, and failure screenshots or logs. | Domain changes, compatibility testing, and troubleshooting. |
| Capacity and recovery | Load-test expected concurrency, refreshes, and interrupted streams, and rehearse recovery. | Latency, failure rates, capacity usage, and recovery time. | Capacity purchases, model calls, monitoring, and service levels. |
The comparable unit for selection should be a complete business workflow, rather than an isolated demonstration page: who signs in, what they can ask, what they can see, who receives the results, how errors are recovered, and who confirms actions. Placing all five platforms in the same integration test matrix lets enterprises compare one-time embedding development, platform or capacity licensing, identity and permission operations, data content maintenance, and AI usage together as three-year total cost of ownership.