Question 1

How do you stop it from touching data a user shouldn't see?

Accepted Answer

Several independent layers. Sign-in at the product level. Then policies that scope a user to particular data through the semantic layer, so the agent can work only with what that user could. Operational sources are read-only unless you say otherwise. And a check on the structured response can reject an answer before it is returned if it contains fields you have disallowed.

Question 2

Can it act on operational systems without a person watching?

Accepted Answer

Not on anything that matters. A step that changes something plans the change, freezes that plan with a fingerprint of its inputs, routes it for approval with timeouts and escalation, runs only on approval, and then writes an append-only record.

Question 3

If something goes wrong three months from now, can we reconstruct what happened?

Accepted Answer

Yes. Look up the workflow and the run id and you get each step, the SQL it ran, the tools it called, the tokens and cost it spent, the outcome of every gate, and which person approved what.

Question 4

Where does our intellectual property live?

Accepted Answer

In your own object storage. Workflow specs, the skill library, custom tools, project memory, run history and the audit log are all versioned there. None of it is held in our systems.

Question 5

Do prompts or data leave our boundary to reach a model?

Accepted Answer

Only if you route them there. Models are chosen per step from a registry your admin controls. A step that touches sensitive data can be pinned to a model you host, and inside your VPC with your own keys, nothing calls home.

Start from your exact problem.

Shocks and pricing traps.

Everyday analysis runs on consumption-priced compute, and the bill climbs with adoption.

A one-second query still bills for sixty, and no auto-suspend setting changes that.

Every agent question fans out into 6 to 12 queries, and each burst bills a full cluster minute.

The agent bill is a black box - we can't map spend to a space, session, or team.

Consumption pricing turned every user and agent into an unbounded budget line.

A scheduled agent loop ran 46 times overnight - $7,000 gone before any alert.

One agent-generated CROSS JOIN auto-scaled the warehouse and burned thousands.

Performance cliffs and cold starts.

At peak load our customer-facing dashboards blew past the 2-second p95 SLA.

A simple agent question on 3,000 rows still takes thirty seconds.

The SQL warehouse is stuck Starting, and the first query just waits.

Use an operational database for low latency is the official lakehouse answer.

Cluster caps and scale ceilings.

Ten concurrent queries per cluster, and a thousand users waiting.

Can one analytics agent serve a thousand users? The limits aren't published.

High-concurrency small jobs turn into an orchestration project.

Wrong answers and eroded trust.

A text-to-SQL agent is only right when someone did the prep.

Empty column descriptions, and an agent that hallucinates to fill the gap.

The agent's number does not match the certified dashboard.

Not seeing yours? Share your problem.