Question 1

How do you stop it from touching data a user shouldn't see?

Accepted Answer

Several independent layers. Sign-in at the product level. Then policies that scope a user to particular data through the semantic layer, so the agent can work only with what that user could. Operational sources are read-only unless you say otherwise. And a check on the structured response can reject an answer before it is returned if it contains fields you have disallowed.

Question 2

Can it act on operational systems without a person watching?

Accepted Answer

Not on anything that matters. A step that changes something plans the change, freezes that plan with a fingerprint of its inputs, routes it for approval with timeouts and escalation, runs only on approval, and then writes an append-only record.

Question 3

If something goes wrong three months from now, can we reconstruct what happened?

Accepted Answer

Yes. Look up the workflow and the run id and you get each step, the SQL it ran, the tools it called, the tokens and cost it spent, the outcome of every gate, and which person approved what.

Question 4

Where does our intellectual property live?

Accepted Answer

In your own object storage. Workflow specs, the skill library, custom tools, project memory, run history and the audit log are all versioned there. None of it is held in our systems.

Question 5

Do prompts or data leave our boundary to reach a model?

Accepted Answer

Only if you route them there. Models are chosen per step from a registry your admin controls. A step that touches sensitive data can be pinned to a model you host, and inside your VPC with your own keys, nothing calls home.

Optimization Hub

Amazon Redshift

ClickHouse

Databricks

Databricks

AWS Athena

Amazon Redshift

BigQuery

BigQuery

ClickHouse

Microsoft Fabric

Microsoft Fabric

Trino

Snowflake

AWS Athena

Snowflake