One governed data layer for every AI agent
Every AI tool your company adopts wants its own connection to the warehouse, its own permissions and its own way to change data. Data Workers gives every MCP-capable agent, yours or ours, one governed layer: trusted context to read, approvals to act, an audit trail for both.
Before and after
| Today | With Data Workers |
|---|---|
| Each AI tool wired to the warehouse on its own | One governed layer every agent connects to over MCP |
| Agents guessing which table or metric is right | Definitions, lineage and owners served before the first query |
| Permissions and personal-data rules that differ by tool | The same permissions and personal-data rules whichever agent asks |
| Changes pushed through side doors | Every change previewed, approved by a named person and signed |
| No view of what agents read or changed | One audit trail across every agent |
Copilots, coding agents and analytics assistants each arrive asking for a warehouse connection, and each one that gets it separately becomes another set of permissions to review. The fix is a single layer between the agents and the data, built on the same protocol they already speak. The pattern is covered in depth in the data layer for AI agents; this page is about the operating change, so rolling out AI assistants stops being a series of one-off integrations.
How it works
1. Connect any agent over MCP
Point any MCP-capable agent at the layer: the coding agents your engineers use (Claude Code, Codex, Cursor, OpenCode), assistants you buy and agents you build. Setup is a short config file, not a platform rollout. The layer runs inside your environment, and nothing is copied out of your stack. The open-source core (11 agents, 160+ MCP tools, Apache-2.0) is free to self-host.
2. Read governed context
Before an agent writes a query, the Data Context & Catalog agent serves what it needs: get_context and explain_table for meaning, lineage and owners, resolve_metric for the approved definition, get_table_schema_for_sql for the right columns. The Data Access & Governance agent applies the same permissions (enforce_rbac) and personal-data rules (scan_pii) to every caller.
3. Act through approvals and audit
Agents read freely but write only through one approval path. Each change arrives as a proposal with its preview and how to undo it, goes to a named approver through request_governance_review, and leaves a signed, tamper-evident record. The highest-risk changes need two different people, and the person who asked cannot be the one who approves. The Observability agent (get_audit_trail) shows what every agent read and changed.
The impact metrics we move
- •New AI agent connected to governed data: from about 2 weeks to 1 day
- •Agent access reviewed: from about 3 days to 1 h
- •Audit evidence of agent activity: from about 2 weeks to 2 h
Where teams start
- •Coding agents. Engineers ask about lineage, quality and blast radius from their editor before changing a model.
- •Analytics assistants. Questions are answered from the authoritative table and the approved metric definition.
- •Agents your teams build. One governed connection replaces a custom integration for each agent.
- •One warehouse, one domain. Read-only credentials on Snowflake, Databricks or BigQuery for the domain with the most AI traffic.
- •A first write. One routine change, such as a schema update or an access grant, sent through a named approver.
What powers it
The Data Context Wizard builds and maintains the shared understanding of your estate: what each table means, who owns it and which source is the trusted one. The Spellbook Data Catalog is the agentic governance and catalog layer, and Autopilot Standards let you write a rule once and have every agent held to it. The Autonomous Data-Conductor coordinates the work and shows what is waiting for approval, while the Data-Agents Swarm supplies the context, governance and observability agents above. See how this plays out in agent governance and audit, enterprise AI context and the AI-ready data team playbook.
The climb: from assisted to autonomous to agentic
Each domain moves up the ladder from our thesis on its own record: agents start by watching and suggesting (L0 and L1), then act after approval (L2). Those three levels run today, and only a domain's owner can raise its level. L3 and L4 are where a domain can go once its review record supports it, not something running now.
The pilot
- •Scope. One domain on one warehouse, with two or three AI agents connected through the layer.
- •First week. Agents start by watching and suggesting, on read-only credentials, and show the fixes they would have made, with receipts.
- •By week two. Routine reads run through governed context on their own; the first approved write goes through a named approver.
- •At day 30. We review the impact metrics against your baseline:
- •New AI agent connected to governed data: from about 2 weeks to 1 day
- •Agent access reviewed: from about 3 days to 1 h
- •Audit evidence of agent activity: from about 2 weeks to 2 h
- •Cost. Start with a pilot ($7,500 one-time, credited in full against the first year). Scale is from $1,000 a month and Enterprise from $3,000 a month, billed annually, with unlimited seats, no usage meter and no markup on model spend. See pricing.
FAQ
Which agents can connect? Any MCP-capable agent: coding agents such as Claude Code, Codex, Cursor and OpenCode, assistants you buy, and agents you build. Our own agents use the same layer. For why we chose the protocol, see why we bet on MCP.
Does our data leave our environment? No. The layer runs inside your environment and agents work where the data lives.
What stays with people? Every write. Agents read freely within their permissions, and anything that changes data waits for a named approver, as described in how approvals work.
What if an agent is wrong? Each proposal shows the change, what it would affect and how to undo it, so the approver catches it before it runs. Every change leaves a signed record of what was asked, approved and run.
Can we try it without buying? The open-source core is free to self-host; it reads, analyses and recommends. Acting on production comes with the paid platform. For how context layers are built, see five architecture patterns.