# Build an Enterprise Architecture AI Agent with Postman & OpenAI Source: https://www.youtube.com/watch?v=z6ipV06v9NA Recap page: https://rapidrecap.app/video/z6ipV06v9NA Generated: 2026-01-13T22:04:21.776+00:00 --- ## Quick Overview The video demonstrates how to build an Enterprise Architecture AI Agent using Postman and OpenAI's Agent Builder, configuring the workflow to first check input for sensitive information, then use the Postman MCP tool to retrieve all available API services, and finally use a custom guardrail to compare the proposed architecture against approved organizational best practices stored in a vector store to ensure compliance before outputting the final design. **Key Points:** - The AI Agent workflow begins with a 'check for sensitive info' guardrail to prevent leakage of secrets like API keys or passwords from the input prompt. - The second step uses the 'postman_getAPIs' agent, which calls the Postman MCP tool 'getCollections' to retrieve all available API services within the agent's configured workspace. - The agent is then instructed to loop through the collection IDs and use the 'postman_getCollection' tool to find endpoints matching the developer's input requirements. - A 'Compare against approved architecture' agent uses a custom prompt check guardrail linked to an 'Approved Architectures' vector store containing best practices (like the 'react_best_practices.md' file). - The custom guardrail instructs the agent to act as a security infrastructure support person, looking for sensitive data, and to flag any proposed API usage that does not adhere to the approved architecture documents. - The final agent step outputs the high-level architecture, confirming that all proposed components (React, S3 hosting, EC2/Servers, RDS/Databases) align with the organization's approved infrastructure standards. - The entire process showcases using Postman tools within an OpenAI Agent workflow to automate enterprise architecture compliance checks against defined best practices. ![Screenshot at 00:04: The initial configuration of the Postman MCP tool within the agent workflow, showing the 'Approval' setting set to 'Never require approval for any tool call' to allow automated execution.](https://ss.rapidrecap.app/screens/z6ipV06v9NA/00-00-04.jpg) **Context:** The video, presented by Quinton Wall (Head of Developer Relations at Postman), provides a tutorial on integrating Postman's capabilities with OpenAI's Agent Builder to create a custom AI agent. This agent is designed to act as an Enterprise Architecture reviewer, automatically validating developer-submitted application ideas against a set of predefined, organizationally-approved infrastructure and coding best practices stored securely in a vector database. ## Detailed Analysis The tutorial details the construction of an Enterprise Architecture AI Agent using Postman and OpenAI Agent Builder. The workflow is structured linearly: Start -> Check for sensitive info -> Postman getAPIs -> Agent (Compare against approved architecture) -> Final Agent (Output). The first node, 'check for sensitive info,' is a guardrail configured to scan input text for credentials or secrets, set to fail if detected. The second step involves the 'postman_getAPIs' agent, which utilizes the Postman MCP tool, specifically the 'getCollections' function, to pull a list of all available API services within the designated Postman workspace. The agent then loops through these collections using the 'getCollection' tool to identify endpoints relevant to the developer's request, which is passed as workflow input. The crucial step is the 'Compare against approved architecture' agent, which employs a custom prompt check guardrail. This guardrail references a vector store containing approved architecture documents, such as 'react_best_practices.md'. The system prompt for this guardrail explicitly tells the model to act as security infrastructure support, flagging any API use that deviates from the approved list (e.g., custom APIs like the Dog Breed Classifier API) or fails to adhere to best practices regarding S3, EC2, or RDS usage. The final agent then produces the high-level architecture, complete with green checkmarks indicating compliance with all organizational standards found in the approved documentation. ### Agent Setup and Security - The workflow starts with a 'check for sensitive info' guardrail to block prompts containing secrets - The agent is configured to use the Postman MCP tool without requiring manual approval for tool calls. ### API Discovery using Postman Tool - The 'postman_getAPIs' agent calls the Postman MCP tool 'getCollections' to dynamically retrieve all available APIs in the workspace - It then iterates using 'getCollection' to find endpoints matching the developer's input. ### Architecture Validation Guardrail - The 'Compare against approved architecture' agent uses a Custom Prompt Check guardrail referencing a vector store containing approved best practices (like react_best_practices.md) - The system prompt instructs the AI to verify compliance, specifically flagging unapproved custom APIs (like the Dog Breed Classifier Service) and ensuring alignment with S3, EC2, and RDS guidelines. ### Final Output and Validation - The final agent returns the high-level architecture design, showing green checks next to approved components (ReactJS, S3 hosting, EC2/Servers, RDS), confirming adherence to organizational standards - The process successfully demonstrates automated governance for application design. ![Screenshot at 00:04: Configuration window for the Postman MCP tool, showing the 'Approval' setting set to 'Never require approval for any tool call'.](https://ss.rapidrecap.app/screens/z6ipV06v9NA/00-00-04.jpg) ![Screenshot at 00:23: Slide detailing the goals of the AI agent: reviewing app ideas, confirming approved APIs, and defining a high-level architecture.](https://ss.rapidrecap.app/screens/z6ipV06v9NA/00-00-23.jpg) ![Screenshot at 00:39: The instruction prompt for the 'postman\_getAPIs' agent, explicitly instructing it to use the 'getCollections' tool and loop through results using 'getCollection'.](https://ss.rapidrecap.app/screens/z6ipV06v9NA/00-00-39.jpg) ![Screenshot at 02:38: The configuration panel for the 'Custom Prompt Check' guardrail, showing the system prompt instructing the agent to act as a security infrastructure support person looking for secrets.](https://ss.rapidrecap.app/screens/z6ipV06v9NA/00-02-38.jpg) ![Screenshot at 06:27: The 'Approved Architectures' vector store configuration, showing the uploaded 'react\_best\_practices.md' file used for hallucination checking.](https://ss.rapidrecap.app/screens/z6ipV06v9NA/00-06-27.jpg)