Same agent question
“Show top buyer organizations”
Requested fields: recognized_revenue + account_contact
Lesson 5 · Agentic security
Same question, two governed answers
For an agentic BI request, the semantic layer is also a governance firewall. It resolves the requester's identity, applies row-level scope and PII policy before the query reaches the warehouse, and moves the audit record with the request.
Audit trail
Audit moves with the request.
Each audit record captures who asked, which policy applied, and which sensitive data class was handled.