The moment you hand an agent warehouse credentials, your governance model is already obsolete.
Prompts aren't policy. Output filters aren't controls. Logs aren't proof.
Every runtime guardrail shares one flaw
It fires after the query ran. The rows moved. You are not preventing exposure — you're annotating it.
That ordering problem is not solvable by making the classifier better. It's solvable by moving the decision earlier.
What actually governs an agent
| Step | What happens | What it prevents |
|---|---|---|
| Intent parsing | Language → typed intent | Prompt injection reaching SQL |
| Context resolution | Entities and metrics resolved against a versioned graph | Guessed column semantics |
| Join proof | Path proven, or compilation fails | Invented relationships |
| Policy injection | RBAC + ABAC + row/column predicates | Unauthorised rows ever being read |
| Audit emission | Question → SQL → predicates → result | An unanswerable post-incident review |
The agent never sees a table it wasn't entitled to. Not because it behaved well — because the query was never compiled.
The test to run on any vendor
Ask what happens when a user requests something they're not entitled to.
If the answer involves filtering the result set, the data already left the warehouse and you're being sold a logging feature as a security control.
If the answer is "compilation fails," you're looking at governance.
Why compile-time is the only defensible position
Regulators don't accept "the model said so" as a control, and they never have. A number that informed a decision has to be reconstructable months later with the definitions that were in force at the time.
That means policy has to be part of query construction, not a wrapper around it — and the audit artefact has to be the SQL itself, not a description of intent.
The full breakdown — the governance architecture step by step, policy composition across scopes, and the audit format — is here:
👉 Governing AI Agents: Why Compile-Time Security is Mandatory
Originally published at colrows.com/blogs/how-to-govern-ai-agents-that-query-enterprise-data
Top comments (0)