Article body
Full article
A Data Agent can query data, create resources, and trigger actions for a user. It inherits every security concern of the BI platform and adds the risk of automated execution. If a multi-tenant SaaS product verifies identity only at the chat entry point, later tool calls can cross data boundaries.
The governing principle is straightforward: every tool call must answer who is acting, in which tenant, against which resource, and with what authority. The decision and its result must remain in the audit chain.
Carry Trusted Identity on Every Call
When an agent runs a query, reads a metric, or creates a dashboard, the backend must re-evaluate tenant, user, and resource permissions. It must not send model-generated SQL directly to the database or trust a tenant ID supplied by the client. The query service should inject tenant filters, row-level rules, and field restrictions from trusted identity context.
A secure call path usually includes:
- An identity gateway validates the user session and tenant membership.
- A policy service combines application, data, and function permissions.
- The tool layer validates parameters, resource state, and operational risk.
- The query or write service executes with a least-privileged identity.
- The audit service records policy decisions, inputs, results, and approvals.
None of these checks can be skipped because the caller is an agent.
Join Three Permission Layers at One Decision Point
| Permission layer | Controlled objects | Decision |
|---|---|---|
| Application | Spaces, portals, dashboards, and reports | May the user enter and view the resource? |
| Data | Rows, fields, connections, and metrics | Which data and definitions may the user see? |
| Function | Modeling, export, publishing, and tool calls | Which actions may the user perform? |
Permission to view a dashboard does not imply permission to export its details. Permission to ask questions does not allow the agent to change a metric definition. The three layers must converge in a server-side, default-deny decision.
Sensitive actions should use narrowly scoped tools. Resource creation, wider sharing, cross-system writes, and bulk export need approval or explicit confirmation. Administrators also need a global kill switch, deny lists, and emergency revocation so that sessions and tokens can be terminated immediately.
Shared and Dedicated Isolation Are Business Choices
A shared database reduces operating cost, but every read path must pass through a common tenant filter. A database per tenant offers stronger physical isolation but increases upgrade, connection, and cross-tenant operational costs. A platform can combine both models by customer tier, provided the security contract identifies where data resides, who can access it, and how backup and migration work.
Isolation must also cover caches, search indexes, object storage, and job queues. Protecting only the primary database still leaves export files, logs, and asynchronous jobs as possible leakage paths.
SSO Provides Identity Consistency, Not Just Login
Enterprises already use SAML, OAuth, or OIDC identity providers. A BI PaaS should reuse the enterprise IdP and map organization, role, and tenant attributes into platform policy. Embedded deployments also need secure token exchange between the host application and BI component without exposing long-lived credentials to the browser.
Session policy includes expiration, revocation, device limits, and anomalous-login detection. A long-running agent task cannot rely on an indefinite token. The executor must recheck authorization at critical steps. If policy changes during execution, the task should stop, fall back to read-only behavior, or request confirmation again.
An Audit Record Must Answer Six Questions
A complete agent audit record identifies:
- who started the task and in which tenant;
- the user’s business goal;
- the tool and tool version the agent called;
- the resources that were read or changed;
- the policy decision and approval result;
- the final result, error, and compensation action.
Prompts and intermediate reasoning can be reduced according to compliance policy, but tool parameters, authorization decisions, and resource changes must remain traceable. Sensitive fields should be redacted before logging. Tokens, secrets, and complete personal records do not belong in event streams.
Expand from a Read-Only Boundary
A production rollout can follow the risk boundary:
- Start with read-only questions over governed datasets.
- Add reversible resource creation with mandatory Dry Run.
- Connect approval to permission changes, export, and cross-system writes.
- Replay high-risk tasks to detect overreach, duplicate execution, and anomalous export.
- Continuously test tenant separation, revocation, and audit completeness.
Automation should expand only after permission and audit controls are mature. Data Agent security is not a property of the chat component; it is the combined result of the platform control plane.
Further reading: HENGSHI SENSE Product and Technology White Paper.