Design AI data features people trust: inherit permissions and metric definitions
A trustworthy data agent should answer only what the connected user can see and only in the team's defined metrics.
| By | Prompt & Product — Newsroom |
|---|---|
| Filed | 17 September 2026 |
| Read | 3 MIN |
Start with the access boundary, not the model
The demo works: a user asks for revenue, churn, or headcount, and the AI returns a number. The number is only defensible if the query inherits the connected user's table, row, and column permissions and uses the team's metric definitions.
A 2024 data.world study found that GPT-4 achieved a 16.7% success rate when generating SQL from raw database schemas. The same study found that grounding GPT-4 with a semantic layer raised SQL-generation accuracy to 54.2%. The missing piece is context. A data agent needs to behave like a careful analyst who already knows the company's rules and the team's vocabulary.
OpenAI launched a Data agent for ChatGPT Work on September 10, 2026. The Data agent can connect to approved company data sources, including Amazon Redshift, Datadog, Google BigQuery, ClickHouse, Databricks, MongoDB, and Snowflake. OpenAI's Data agent is controlled by enterprise administrators who select available data connections and roles, and its queries inherit the connected account's existing table, row, and column permissions.
That boundary keeps the AI inside the access the user already has. A sales manager must not see a customer row the platform hides. A finance analyst must not receive a column the data platform masks. If the agent can bypass those limits, the product adds a leak, not a shortcut.
OpenAI said almost every member of its product team and over two-thirds of its go-to-market staff already use data agents in ChatGPT Work. OpenAI named NTT Data, Thermo Fisher, and ServiceTitan as Alpha program organizations using the Data agent. The pattern is moving from pilot to daily work, which raises the stakes for access control.
Run the two-question data-trust audit
Before shipping any AI feature that touches business data, ask two questions. Does the query inherit the connected user's table, row, and column permissions? Does the feature require the team's metric definitions or semantic context before answering? Use the checklist below to test both.
- Ask the connected user's role for a row or column that role cannot see, and the answer should be blocked.
- Ask for a table the role cannot open, and the agent should not return a summary, sample, or workaround.
- Ask for a metric the team has not defined, and the feature should stop or ask for the definition before computing.
- Ask the same question in a dashboard and a chat, and the numbers should match the governed definition.
- Check whether administrators can turn off a data source or role without changing the model.
- Check whether access can change with user context, data attributes, or legal obligations.
The first two items test permission inheritance; the third tests metric definitions; the last two test whether the product can be governed after launch.
Make metric definitions part of the product
A model can produce a number without knowing what the company means by it. AtScale reported 92.5% accuracy on the TPC-DS benchmark when it enforced valid join paths and pre-defined metrics. A semantic layer gives the model a shared vocabulary: what counts as revenue, what joins are valid, what dimensions are allowed.
For interpretation, OpenAI's Data agent draws on the company's business definitions and metric logic from semantic layers including dbt, GitHub, Snowflake Horizon, and Databricks Genie Ontology. Snowflake Semantic Views define consistent business metrics and dimensions as a governed semantic layer for Snowflake AI applications, including CoWork and Cortex Agents. AtScale's June 2, 2026 XMLA Endpoint for Snowflake Semantic Views is designed to ground Cortex Agents, CoWork, dashboards, and spreadsheets in the same governed definitions. Keep the AI dashboard and the spreadsheet aligned, so the user can compare them without guessing.
Put guardrails where users can see them
Users will not audit the model; they will compare the answer to a dashboard. The product should show which data source is connected, which role is active, and which definitions are being used. When a query is blocked, the message should name the missing permission or missing definition, not just say try again.
Trust3 AI's June 1, 2026 Snowflake integration uses user context, data attributes, and legal obligations to apply dynamic access restrictions to agent data access. Snowflake's managed MCP server model provides OAuth authentication, role-based controls over MCP servers and tools, and distinct permissions for connecting to a server versus calling its tools. Data access guardrails need to be inspectable, reversible, and tied to the person asking.
In a demo, answer the two audit questions before the feature answers any business question. If either answer is no, stop, name the missing permission or definition, and ask for the missing context.
