How an agent reaches enterprise data
Distinct from an agent remembering its own thoughts: this is the enterprise agent talking to a data warehouse. Two layers: the patterns (how a question becomes a governed answer) and the suppliers (the text-to-SQL + semantic-layer vendors who productise them).
| Pattern | How it works | Strength | Watch-out | Example | src |
|---|---|---|---|---|---|
| Text-to-SQL Query generation | The agent translates a natural-language question into SQL, runs it against the warehouse, and reads the result set back. The dominant pattern for structured enterprise data. | Direct access to governed tables; exact, aggregatable answers over billions of rows. | Schema-grounding is hard at enterprise scale: ambiguous columns, joins and business logic cause silent wrong answers. Benchmarks (BIRD) still sit well below human accuracy. | Vanna · Snowflake Cortex Analyst · Databricks Genie | ↗ T1 |
| Semantic / metrics layer Governed query | Instead of raw SQL, the agent queries a governed semantic model where metrics, joins and definitions are pre-defined. The layer compiles the request to correct SQL, so 'revenue' always means the same thing. | Consistency + governance, the agent can't mis-define a metric; business logic lives in one place, not the prompt. | Only as good as the modelled layer; anything not defined in the semantic model is invisible to the agent. | dbt Semantic Layer · Cube · Looker (LookML) | ↗ T1 |
| Code-execution analytics Execution | The agent writes Python/pandas (or SQL) and runs it in a sandbox over the data, iterating on the output: the same loop a data analyst runs. Handles transforms, stats and charts beyond a single query. | Open-ended analysis, pivots, models, plots, not just retrieval. Self-corrects by reading its own errors. | Needs a secure sandbox (see Security · Governance); ungoverned code execution over live data is a real risk surface. | ChatGPT Advanced Data Analysis · Julius · Hex Magic | ↗ T1 |
| Knowledge-graph query (GraphRAG) Graph traversal | Data is structured as an entity/relationship graph; the agent traverses it (Cypher/SPARQL) or retrieves graph-derived community summaries. Answers multi-hop questions a flat index can't. | Multi-hop reasoning + global questions ('what themes span these 10,000 docs') that vector RAG misses. | Graph construction + maintenance cost is high; stale graphs mislead. Overkill for simple lookups. | Microsoft GraphRAG · Neo4j + LLM · Zep/Graphiti | ↗ T1 |
| RAG over documents + rows Retrieval | Embed enterprise documents (and sometimes row-level records), retrieve the top-k by similarity, and inject them as context. The default for unstructured + semi-structured enterprise knowledge. | Works over messy unstructured data (contracts, tickets, wikis) with no schema; cheap to stand up. | Retrieval quality caps answer quality; chunking + freshness + access-control at retrieval time are the hard parts. | Glean · LlamaIndex · vector DB + reranker | ↗ T1 |
| MCP-to-database Protocol | A Model Context Protocol server exposes a database/warehouse as agent-callable tools (list tables, run query, describe schema). The agent discovers and queries the data source at runtime: no bespoke integration. | Standardised, discoverable access with the auth + scoping handled by the MCP host, not the model. Reusable across agents. | Only as safe as the server's scoping; a broad read/write MCP over production data is a governance decision, not a default. | Postgres MCP · Snowflake MCP · modelcontextprotocol/servers | ↗ T1 |
| Vendor | Category | How it works | Runs on | OSS | src |
|---|---|---|---|---|---|
| Snowflake Cortex Analyst | Warehouse-native text-to-SQL | Uses a YAML semantic model to translate natural-language questions into SQL that runs on Snowflake tables: governed text-to-SQL inside the warehouse. | Snowflake | no (platform) | ↗ T1 |
| Databricks AI/BI Genie | Warehouse-native text-to-SQL | Conversational analytics on top of Unity Catalog: generates SQL from natural language against governed lakehouse tables. | Databricks | no (platform) | ↗ T1 |
| Vanna AI | Open-source text-to-SQL | Open-source RAG framework for text-to-SQL: train on your schema + docs + prior queries, then ask questions in natural language against any SQL database. | any SQL DB | yes (open-source) | ↗ T2 |
| Dataherald | Open-source text-to-SQL | Open-source natural-language-to-SQL engine for enterprise relational data, focused on accuracy on large complex schemas via context + fine-tuning. | any SQL DB | yes (open-source) | ↗ T2 |
| Cube | Semantic layer | A headless semantic layer that defines metrics, dimensions and joins once, then serves consistent definitions to BI + AI agents. Agents query governed metrics, not raw SQL. | any warehouse | yes (open-core) | ↗ T1 |
| dbt Semantic Layer | Semantic layer | MetricFlow-powered semantic layer, metric definitions live in dbt and compile to correct SQL, so every consumer (agent or BI) gets one definition of a metric. | any warehouse | partial | ↗ T1 |
| AtScale | Semantic layer | Enterprise universal semantic layer with a live cache/acceleration engine: governed metrics for BI + AI over the warehouse without moving data. | any warehouse | no (platform) | ↗ T2 |
| Looker (LookML) | BI-native semantic model | Google's BI-native semantic model, LookML defines governed metrics + joins that agents and dashboards both consume, keeping business logic in one place. | Google Cloud + warehouses | no (platform) | ↗ T1 |
| GoodData | BI-native semantic model | Headless BI + semantic model with an analytics API and AI assistant: governed metrics served to agents via API rather than raw SQL. | any warehouse | no (platform) | ↗ T2 |
Text-to-SQL, semantic layers, GraphRAG, MCP, and the vendors behind them
Data access is how an agent reaches the systems of record it does not own: the warehouse, the CRM, the ticketing system. Three patterns dominate, text-to-SQL, retrieval over an index, and tool calls through MCP.
Show more
They differ mainly in where correctness is enforced. Generated SQL is powerful and fails silently on a wrong join; a tool call is narrow and validated by whoever wrote it. The direction of travel is toward the narrow path, because a bounded interface is easier to govern than a general one.
How do AI agents query enterprise data?
Three routes, usually. Generate SQL and run it against the warehouse, search an index of documents, or call a tool that owns the query and the permissions. Which one fits depends on whether the answer lives in rows, in text, or in a system with its own API.
What is text-to-SQL?
Turning a plain-English question into a SQL query, running it, and reading the result back. It gives exact answers over huge tables, which document search cannot. The difficulty is the schema: ambiguous column names, joins and business rules produce queries that run fine and return the wrong number.
How accurate is text-to-SQL?
Useful, but not accurate enough to trust unchecked. On realistic enterprise benchmarks it still sits well below what a human analyst achieves, and the failures are silent rather than obvious. That is why most deployments show the generated SQL and restrict it to a governed data model.
What is a semantic layer?
One place where metrics, dimensions and joins are defined in business terms. The agent queries those definitions instead of raw tables, so "revenue" means one agreed thing rather than a guess at which columns to add up. Cube, dbt and AtScale are common, and Looker does the same job inside BI.
What is GraphRAG?
Retrieval over a knowledge graph rather than a pile of text chunks. Entities and their relationships are extracted first, so the system can answer questions needing several hops, such as which suppliers connect to an at-risk part. It costs more to build the index and pays off when the relationships are the answer (arXiv).
How do you stop an agent leaking data it should not see?
Give it the permissions of the person asking, not its own. Access should run through the same governance layer as any other query, so row and column rules apply before results come back. Narrow tools beat open SQL access here, because each one defines exactly what it is allowed to do.