Use cases · 04
Broad read access is the whole risk.
An agent answering questions about your business needs to see most of the warehouse. That is the opposite of least privilege, and it is why data teams stall on agents that would otherwise save them a week a month.
01 / the premise
You cannot scope an analyst agent down to nothing and still get an answer.
The useful agent reads across tables it was not told about in advance, because that is what exploratory analysis is. Locking it to three approved views makes it useless; giving it the warehouse makes it a data-exfiltration risk with a natural language interface.
The resolution is not narrower read access. It is read access that is column-aware, egress-controlled, and fully recorded, so breadth stops being dangerous.
02 / what the agent does
- 1
Explore
Inspect schemas, sample tables, find the right grain.
- 2
Query
Write and iterate SQL until the numbers reconcile.
- 3
Build
Propose a model, a test, and a backfill plan.
- 4
Publish
Open a pull request against the transformation repository.
03 / what goes wrong
The failures that keep this in pilot.
| Failure | How it happens | What stops it |
|---|---|---|
| PII egress | A query selects email and card fields, and the result is sent to a model provider inside the prompt. | Column-level denies with redaction applied before the result leaves the gateway. The agent sees a hash, not the value. |
| Full-table scan | An unbounded query against a billion-row table burns the warehouse budget in minutes. | Row and byte-scanned ceilings per query and per session, enforced before the statement runs. |
| Silent schema change | A helpful agent adds a column or drops an index to make its query faster. | DDL is a separate tool and denied by default. Structural changes escalate to a data owner. |
| Wrong environment | A connection string in context points at production when the agent believed it was in staging. | The session binds to one warehouse and one role. A statement against another target is denied outright. |
| Unreviewable answer | A number lands in a board deck and nobody can reconstruct the query that produced it. | Every statement and its result digest are in the evidence chain, so any figure can be traced back and re-run. |
04 / the boundary
What you actually write down.
# velone.policy.yaml · analytics agent
version: 4
session: analyst-agent
ring: 2
scope:
warehouse: "snowflake://acme/analytics"
role: "AGENT_READONLY"
tools:
db.query:
allow: true
deny_args: ["DROP", "TRUNCATE", "DELETE", "UPDATE", "INSERT", "GRANT"]
max_rows: 50000
max_bytes_scanned: 20GB
db.ddl:
allow: false # never
files.write:
allow: true
paths: ["/workspace/models/**"]
git.push:
allow: true
deny_branches: ["main"]
data:
deny_columns:
- "customers.email"
- "customers.phone"
- "payments.card_*"
- "employees.salary"
redact: hash # joinable, not readable
egress:
default: deny
allow: [github.com]
budget:
bytes_scanned: 500GB
wall_clock: 3hHash redaction is the detail that makes this workable: the agent can still join on a customer email to get a correct count, without ever being able to read one.
05 / what changes
- Breadth without exposure
- The agent explores the warehouse freely while regulated columns stay unreadable at the boundary.
- Cost control
- Bytes-scanned ceilings per session turn an open-ended risk into a line item you set in advance.
- Reproducible numbers
- Every figure traces to a recorded statement you can re-run and compare.
- Read-only by construction
- Write and DDL paths are denied at the kernel, not merely absent from the role's grants.
- Reviewable output
- Models arrive as pull requests with the exploration attached, so review is about the logic rather than archaeology.
06 / questions
Why not just use warehouse roles?
Use them — this sits on top. A role cannot cap bytes scanned per agent session, cannot redact a column for one caller and not another, and cannot produce an attributable record of which agent ran which statement on whose behalf.
Does redaction break joins?
No, when it is deterministic hashing. Equality and grouping still work; only readability is removed. For cases needing real values, the column escalates instead.
Which warehouses are supported?
Snowflake, BigQuery, Databricks, Redshift, and Postgres today. The gateway speaks the wire protocol, so the agent uses its normal driver.
Can the agent build dbt models?
Yes. It writes into the models directory in the sandbox and opens a pull request. It cannot apply a transformation to production directly.
keep reading
Ring 0
Give an agent the warehouse, safely.
Bring the three columns your legal team will not let an agent read. We will show you an agent that still answers the question.