Least-privilege access
Give agents the least access that does the job. Two platform rules make this workable:
- Read agents can never mutate your systems. The read path is structurally read-only.
- Write is opt-in, per system. Write behavior requires a separate, explicitly enabled, write-scoped credential — and on Enterprise, an approval gate in front of every write. Never widen a read credential to add write.
Minimum read grants by system
Section titled “Minimum read grants by system”| System | Minimum grant for read agents |
|---|---|
| Snowflake | A role with USAGE on warehouse/database/schemas and SELECT on the tables in scope; access to SNOWFLAKE.ACCOUNT_USAGE views if you want cost and query-history analysis |
| Databricks | A service principal with USE CATALOG/USE SCHEMA and SELECT on the catalogs in scope (Unity Catalog) |
| BigQuery | A service account with roles/bigquery.metadataViewer plus roles/bigquery.dataViewer on in-scope datasets; add roles/bigquery.resourceViewer for job/cost analysis |
| DataHub | A read token for the GMS API |
| OpenMetadata | A bot/JWT with read scope |
| dbt Cloud | A read-only API token scoped to the account |
Start with one schema or one database, verify it works, then widen scope — the agents are useful on a slice of the estate, and a scoped rollout is an easier security conversation.
Service accounts, not personal credentials
Section titled “Service accounts, not personal credentials”For any team rollout (Start and up), create dedicated service accounts per system, store them in your secret manager, and rotate them on your normal schedule. A rotated or expired credential shows up as 🔴 Needs attention on the next verification test — that’s the system working as intended, not an outage.
Where credentials live
Section titled “Where credentials live”On local installs, credentials are environment variables on your machines and are used to call your systems directly — they are never sent to Data Workers. On hosted and dedicated deployments (Scale/Enterprise), credential handling is part of your provisioning conversation, inside the boundary you chose. Details: How your data is handled.