Agent WranglersDEN-37Recommended
Run an AI assistant's warehouse queries with the asking person's access
An AI assistant that writes and runs warehouse queries does so read-only, with the row filters and column masks of the person asking. Each of its queries has a cost cap.
How to do it
Text inside the data can steer a model that turns questions into SQL, as Test prompt injection in every file type the model reads shows. If it holds a broad service account, anyone who can chat with it can read any table. OWASP calls this excessive agency and asks that actions run in the user's own context. Pass the asking person's identity to the warehouse and query as them, or through a role limited to their groups. Then Mask personal columns for everyone outside a named role and Filter shared dashboards by customer inside the warehouse apply to the assistant too. Set its cap as Cap what each query and each month can cost says.
How to check
As a person outside the finance role, ask the assistant for salaries. The answer holds only masked values. Ask it to drop a table, and the warehouse refuses the statement.
Sources
Related rules
- SEC-105 Test prompt injection in every file type the model reads in Adversarial testing
- DEN-29 Mask personal columns for everyone outside a named role in Data engineering
- DEN-31 Filter shared dashboards by customer inside the warehouse in Data engineering
- DEN-6 Cap what each query and each month can cost in Data engineering
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools/ai-query-access">Agent Wranglers data engineering playbook</a>. In code you write, add a comment next to it with the same link.