Semantic Layer vs. Knowledge Graph: Choosing Your AI Data Foundation

Nilesh Kumar — Fri, 07 Aug 2026 17:18:30 +0000

Knowledge graph people and semantic layer people keep arguing past each other.

One models how things relate. The other proves what a number means. You probably need both.

The honest division of labour

	Knowledge graph	Semantic layer
Models	Entities and relationships	Metrics, grain, filters, policy
Strong at	Traversal, inference, causality	Aggregation, definition, governance
Weak at	Math and consistent aggregates	Anything not modelled as a metric
Typical failure	Ontology drifts, nobody notices	Question falls outside the metric set
Answers	"How is X connected to Y?"	"What is X, exactly, for this person?"

Ask an agent "why did EMEA churn spike after the pricing change" and you need both: the causal path through the graph, and a metric definition precise enough that the number is defensible.

Where the argument actually goes wrong

Treating them as competing purchases. They operate on different layers of the same problem — one is topology, the other is semantics plus policy.

The real question is neither. It's which layer executes. A graph and a definition are both inert until something compiles them into governed SQL and runs it against your warehouse.

The execution gap

That's the piece most architectures are missing. You can have an immaculate ontology and a complete metric catalogue and still have no answer to:

Does a valid join path exist for this specific question?
Is this caller entitled to these rows?
Can I reproduce this answer in six months?

Intent → context resolution → constrained planning → governed execution. The graph feeds step two. The semantic layer feeds steps two and four. Neither performs step three.

The full breakdown — the division of labour in detail, a worked customer-risk example, and how the two compose — is here:

👉 Semantic Layer vs. Knowledge Graph: Choosing Your AI Data Foundation

Originally published at colrows.com/blogs/semantic-layer-vs-knowledge-graph

Governing AI Agents: Why Compile-Time Security is Mandatory

Nilesh Kumar — Wed, 05 Aug 2026 14:28:24 +0000

The moment you hand an agent warehouse credentials, your governance model is already obsolete.

Prompts aren't policy. Output filters aren't controls. Logs aren't proof.

Every runtime guardrail shares one flaw

It fires after the query ran. The rows moved. You are not preventing exposure — you're annotating it.

That ordering problem is not solvable by making the classifier better. It's solvable by moving the decision earlier.

What actually governs an agent

Step	What happens	What it prevents
Intent parsing	Language → typed intent	Prompt injection reaching SQL
Context resolution	Entities and metrics resolved against a versioned graph	Guessed column semantics
Join proof	Path proven, or compilation fails	Invented relationships
Policy injection	RBAC + ABAC + row/column predicates	Unauthorised rows ever being read
Audit emission	Question → SQL → predicates → result	An unanswerable post-incident review

The agent never sees a table it wasn't entitled to. Not because it behaved well — because the query was never compiled.

The test to run on any vendor

Ask what happens when a user requests something they're not entitled to.

If the answer involves filtering the result set, the data already left the warehouse and you're being sold a logging feature as a security control.

If the answer is "compilation fails," you're looking at governance.

Why compile-time is the only defensible position

Regulators don't accept "the model said so" as a control, and they never have. A number that informed a decision has to be reconstructable months later with the definitions that were in force at the time.

That means policy has to be part of query construction, not a wrapper around it — and the audit artefact has to be the SQL itself, not a description of intent.

The full breakdown — the governance architecture step by step, policy composition across scopes, and the audit format — is here:

👉 Governing AI Agents: Why Compile-Time Security is Mandatory

Originally published at colrows.com/blogs/how-to-govern-ai-agents-that-query-enterprise-data

DEV Community: Nilesh Kumar