--- title: "Run an AI assistant's warehouse queries ยท Agent Wranglers" url: https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools/ai-query-access id: DEN-37 level: Recommended updated: 2026-10-22 build: a2a6bdfed830 tokens: 862 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Run an AI assistant's warehouse queries with the asking person's access For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Access and BI tools](https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: DEN-37 - Level: Recommended - Chapter: [Access and BI tools](https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools.md) - Rule: An AI assistant that writes and runs warehouse queries does so read-only, with the row filters and column masks of the person asking. Each of its queries has a cost cap. - Check: As a person outside the finance role, ask the assistant for salaries. The answer holds only masked values. Ask it to drop a table, and the warehouse refuses the statement. - How: Text inside the data can steer a model that turns questions into SQL, as [Test prompt injection in every file type the model reads](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/file-prompt-injection.md) shows. If it holds a broad service account, anyone who can chat with it can read any table. OWASP calls this excessive agency and asks that actions run in the user's own context. Pass the asking person's identity to the warehouse and query as them, or through a role limited to their groups. Then [Mask personal columns for everyone outside a named role](https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools/column-masking.md) and [Filter shared dashboards by customer inside the warehouse](https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools/dashboard-row-security.md) apply to the assistant too. Set its cap as [Cap what each query and each month can cost](https://agentwranglers.se/playbook/data-engineering/warehouse-and-models/query-cost-limits.md) says. ## Sources - [OWASP LLM06:2025 Excessive Agency](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/) ## Related rules - SEC-105 [Test prompt injection in every file type the model reads](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/file-prompt-injection.md) in Adversarial testing - DEN-29 [Mask personal columns for everyone outside a named role](https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools/column-masking.md) in Data engineering - DEN-31 [Filter shared dashboards by customer inside the warehouse](https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools/dashboard-row-security.md) in Data engineering - DEN-6 [Cap what each query and each month can cost](https://agentwranglers.se/playbook/data-engineering/warehouse-and-models/query-cost-limits.md) in Data engineering **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers data engineering playbook`. In code you write, add a comment next to it with the same link. - Previous: [Limit exports and public links from BI tools](https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools/bi-sharing-limits.md) - [Access and BI tools](https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools.md)