Let agents query the warehouse without draining it

Natural-language SQL is one tool call away from a full-table export. Constrain the statement, cap the pull, and mask what comes back.

For: Data platform owners exposing Snowflake, BigQuery, or Databricks to agents

A warehouse connector usually exposes one very powerful tool: run this SQL. That single tool is the entire attack surface. A misread instruction turns "summarize last quarter" into a SELECT * across a table of customer records, or an EXPORT/COPY INTO that ships the data straight out.

The policies inspect the SQL argument at ingress. guard-warehouse-sql denies DML, DDL, and grant statements and forces read-only queries; guard-warehouse-export blocks the export and stage-copy constructs that relocate data in bulk. fence-sensitive-schemas keeps the agent out of the schemas holding regulated data, and redact-pii-egress masks identifiers in the rows that do return. Because managed warehouse servers expose admin-named and dynamic tools, pair these with default-deny-unknown-tools so a tool nobody audited is denied until it's reviewed.

The same pattern ports across Snowflake, BigQuery, and Databricks — one warehouse posture, three engines.