Making Your Information Prepared for Agentic AI

Brokers deal with each worth as fact

Contemplate a concrete state of affairs. A pricing agent is requested for the
present worth of Product X. Yesterday, the value was up to date from
$49.99 to $59.99. However the agent’s knowledge supply hasn’t refreshed, it
nonetheless reveals the outdated quantity.

The agent does not hesitate, it retrieves $49.99, quotes the
buyer, the client buys, and the corporate loses $10 on each unit
bought. Each step the agent took was technically appropriate. It adopted
its workflow completely. The knowledge it accessed was the
drawback.

A human gross sales rep would have paused: “Wait, did not we replace this
final week?” They’d double-check. They’ve institutional reminiscence and a
really feel for when one thing’s off. The agent has neither. Errors do not
set off warnings; they cascade silently via the workflow. And
this is not a uncommon edge case. Within the 2026 State
of Information Integrity and AI Readiness report, Exactly and Drexel
College’s LeBow Faculty of Enterprise surveyed 505 knowledge and analytics
leaders, of whom 87% believed their knowledge was prepared for AI, but 43% named
knowledge readiness as the one largest barrier to getting worth from it. That
hole between confidence and readiness is the organization-level model
of the pricing agent, positive of itself and unsuitable. A separate KPMG World AI Pulse survey of two,145 leaders factors the
identical manner, with almost half of executives now seeing AI’s prices exceed its
advantages. Most enterprises are one stale discipline away from the state of affairs
above.

Schema is legislation: knowledge contracts as code

So how do you forestall AI brokers from accessing dangerous or stale
knowledge? The reply is knowledge contracts, treating schema as legislation,
not a well mannered suggestion.

This reverses a decade of “schemaless is versatile” considering,
for human shoppers, unfastened schemas are merely inconvenient, whereas
for AI brokers, they’re harmful. An information contract, written within the
Open Information Contract
Commonplace,
the format the Information Contract CLI
makes use of (and really useful in Thoughtworks tech radar
33),
defines the principles explicitly. A product_pricing contract may
specify:

• Properties with strict logical sorts.
• A top quality rule that worth should be larger than zero.
• A top quality test on foreign money that rejects something outdoors USD, EUR, or
  GBP.
• Critically, a freshness SLA, pricing knowledge should have been refreshed
  throughout the final 24 hours.

Within the Open Information Contract Commonplace, that contract is proven
beneath.

apiVersion: v3.1.0
type: DataContract
id: product-pricing
title: Product Pricing
model: 1.0.0
standing: energetic
schema:
  - title: product_pricing
    physicalType: desk
    properties:
      - title: product_id
        logicalType: string
        physicalType: varchar(64)
        required: true
        distinctive: true
        primaryKey: true
        primaryKeyPosition: 1
      - title: worth
        logicalType: quantity
        physicalType: decimal
        required: true
        high quality:
          - sort: sql
            description: Each worth should be larger than zero
            question: SELECT min({property}) FROM {object}
            mustBeGreaterThan: 0
      - title: foreign money
        logicalType: string
        physicalType: varchar(3)
        required: true
        high quality:
          - sort: sql
            description: Forex should be a supported ISO code
            question: SELECT depend(*) FROM {object} WHERE {property} NOT IN ('USD', 'EUR', 'GBP')
            mustBe: 0
      - title: ingested_at
        logicalType: timestamp
        physicalType: timestamp
        required: true
slaProperties:
  # the rule that may have caught the stale-price state of affairs
  - property: latency
    worth: 24
    unit: h
    aspect: product_pricing.ingested_at

Enforcement occurs alongside three dimensions.

• Schema enforcement ensures sorts and constraints are revered and made
  specific by the contract.
• Freshness SLAs outline the utmost acceptable staleness per dataset,
  nightly batch updates aren’t sufficient when an agent solutions in actual time.
  Key the SLA to when the info was final efficiently loaded, not when a worth final
  modified, in order that regular knowledge is not flagged as stale and a stalled pipeline cannot
  masquerade as contemporary.
• High quality gates validate contracts in CI/CD, blocking deployments when
  they fail.

Discover how this modifications the sooner pricing state of affairs, it
prevents it by design. If the pricing knowledge hasn’t been refreshed
in 24 hours, the contract is violated earlier than the agent ever sees
the info.

The quarantine sample

Defining a contract is one factor. What occurs when knowledge
violates it? You want a circuit breaker and that is the
quarantine sample.

The stream works like this. Uncooked knowledge arrives from supply
programs, APIs, databases, streams. Earlier than it enters the agent
accessible knowledge retailer, it passes via a contract validation
gate that checks three issues, does it match the schema, is it
throughout the freshness SLA, and does it move the standard
guidelines?

If it passes all three, it flows into the licensed, agent
prepared tier. If it fails any certainly one of them, it is quarantined,
routed to a lifeless letter queue for human assessment, with alerts
fired.

The purpose is that the agent by no means sees the dangerous knowledge. It
does not get poisoned by stale costs or corrupted embeddings. In
the pricing state of affairs, if the ingested_at timestamp is older
than 24 hours the contract is violated and the file is
quarantined, so when requested in regards to the worth the agent says, “I
haven’t got present pricing knowledge” moderately than confidently quoting
the unsuitable quantity. That could be a much better failure mode. And it is a job
for the info structure, not the mannequin. A greater mannequin will not rescue
you from dangerous knowledge.

Medallion structure for brokers

A medallion structure is an analytical knowledge design sample for
organizing knowledge in a lakehouse,
popularized by Databricks.

Unhealthy knowledge will get quarantined, however the place does the good knowledge go?
That is what the medallion structure organizes, and its first three
tiers are effectively established:

• Bronze: uncooked, immutable ingestion. You retain every little thing for audit path
  and lineage.
• Silver: validated and deduplicated. Schema is utilized, knowledge contracts
  are enforced, and that is the place the quarantine sample lives.
• Gold: licensed. That is what the semantic mannequin compiles towards,
  entry is ruled, and metrics are trusted.

For agentic architectures, there is a helpful fourth tier value
including: Adaptive Gold the place brokers change into energetic
individuals in knowledge curation moderately than passive shoppers (proven
within the determine beneath). They monitor their very own question patterns,
determine regularly accessed mixtures, and materialize optimized
datasets, successfully constructing their very own warehouse views based mostly on
actual utilization. The concept that brokers can actively curate knowledge, moderately
than solely learn it, is already in manufacturing, at DataHub’s CONTEXT 2025 summit, Apple
described brokers appearing as “digital stewards” of its knowledge catalog,
repeatedly scanning metadata, flagging gaps, and proposing
updates, turning passive documentation into an energetic governance
accomplice. Apple’s brokers curate the catalog; Adaptive Gold factors
that very same active-curation sample on the datasets themselves. That
final step is an extrapolation, however a modest one from one thing
already working.

The important thing architectural precept is that brokers ought to solely
entry Gold tier or above. Bronze and Silver exist for
lineage, debugging, and human investigation. Exposing uncooked or
partially validated knowledge to brokers invitations the
pricing drawback again in.

The identical guidelines for unstructured knowledge

The whole lot thus far has appeared like a desk, costs, currencies,
timestamps, however most of what brokers devour is not tabular. It is
paperwork, wikis, PDFs, and assist tickets, chunked and embedded
right into a vector retailer for retrieval. In case your brokers do RAG, that is
the info they run on, and it wants the identical belief ensures, even
although you possibly can’t write worth > 0 on a paragraph. The patterns
carry over, solely the standard dimensions change.

The stale-price state of affairs has a twin right here. A coverage doc will get
up to date, however the vector index is not re-embedded, so the agent
retrieves the outdated model and solutions confidently from it, the identical
failure because the stale worth, solely now it is an embedding moderately than a
row. The freshness SLA carries over, however be exact about what
the clock measures, the purpose is not when the content material final modified,
it is when the index was final efficiently rebuilt towards its
sources. A 24-hour SLA means the re-indexing job should have accomplished
throughout the final 24 hours, if it hasn’t, the index is stale and
quarantined even when nothing seems to have modified, as a result of a
silently failed indexer is strictly when you possibly can’t inform whether or not
one thing did. That one heartbeat catches each the up to date however
unindexed doc and the pipeline that quietly stopped.

Contracts transfer from the content material to the encircling metadata.
You’ll be able to’t constrain the prose, however you possibly can require that each chunk
carry a supply, a model, a timestamp, and an entry scope, and
reject something that does not. That metadata can be what makes
retrieval traceable and governable later.

High quality gates get checks suited to textual content, reject empty or
truncated chunks, catch near-duplicate paperwork that skew
retrieval, flag failed extractions and OCR rubbish, and look ahead to
embedding drift. A malformed or empty embedding warps similarity
search, so it by no means reaches the shop, for a similar cause a foul
worth by no means reaches the agent, a warped index makes the agent
retrieve confidently unsuitable content material.

Whether or not the info is a priced row or an embedded paragraph, the
job is an identical. The structure has to odor what’s dangerous earlier than
the agent does.

Confidence-threshold routing

Contracts, quarantine, and the medallion structure deal with the
clear circumstances. However there is a grey space, knowledge that is not clearly dangerous,
however is not absolutely reliable both. That is the place
confidence-threshold routing is available in, bridging full autonomy
and full human management.

The agent processes a request and assesses knowledge high quality alerts,
and checks not simply mannequin confidence, however data-level alerts
like freshness, completeness, and consistency. If confidence is at
or above the edge (say 85%), the agent proceeds autonomously.
Under it, the agent defers to a human. The brink is configurable
per use case, for instance, pricing may demand 90%, whereas an
inner FAQ is okay at 70%.

Let’s return to the pricing state of affairs one final time. The value
knowledge is three days stale; the freshness SLA says 24 hours. The SLA
violation routinely drives the arrogance rating beneath the
threshold, no matter how assured the mannequin itself feels about
its reply. The agent ought to reply by pulling a human in:

“I am not assured this worth is present. Routing to a human for
verification.”

In different phrases, knowledge high quality alerts ought to drive the
threshold, not simply the mannequin’s personal confidence. A mannequin might be
positive of a stale reply, and the freshness SLA overrides that
misplaced certainty.

The onerous half is popping these high quality alerts right into a single
rating and weighing it towards the mannequin’s personal confidence. That is an
open design drawback, not a solved one. Begin with a tough gate moderately
than a easy composite. Any contract or SLA breach forces a human,
no matter how the opposite alerts look. Add weighted scoring later,
and solely as soon as you possibly can present it beats that easy rule.

The place to start out

You do not have to construct all of this directly, and most groups
cannot. Contracts, quarantine gates, a medallion structure, and
confidence-threshold routing are so much to face up in a single go. The
excellent news is that they are additive, every one lowers threat by itself,
and you’ll layer in the remainder over time. Start with the very best
leverage strikes and increase from there.

1. Outline freshness SLAs for each dataset brokers contact. The identical
   dataset can have completely different freshness necessities per shopper, akin to a
   pricing desk that is positive on nightly batches for a dashboard may have close to actual
   time updates when a quoting agent depends upon it.
2. Implement quarantine gates. Validate towards contracts earlier than knowledge
   enters agent accessible storage. Begin along with your highest threat datasets akin to
   pricing, stock, buyer data.
3. Begin with the Information Contract CLI. Deliver contract governance into
   CI/CD, outline contracts as YAML, validate routinely, block deployments on
   failure. Deal with knowledge contracts with the identical rigor you’d give an API
   contract.
4. Add confidence threshold routing. When high quality alerts drop beneath a
   threshold, defer to a human. Begin excessive (round 90%) and regulate downward as you
   construct belief and observe accuracy.

We have made knowledge reliable. However when brokers act autonomously on that knowledge,
who’s watching?

The audit hole

Image a financial institution working agentic AI for commerce finance, the place the governance
structure is the true innovation.

An agent processes a letter of credit score. It checks KYC knowledge, verifies the
buyer is not on a sanctions record, evaluates the credit score phrases, and approves a
$2.4 million transaction, all in about 30 seconds. Six months later, a regulator
asks a easy query, “Why was this accredited?”

Conventional audit logs can let you know what occurred, which tables have been
queried, at what time, by which service account. What they cannot let you know is
why. Why did the agent test the sanctions record earlier than the credit score phrases? Why
did it approve regardless of a minor documentation discrepancy? What alternate options did
it think about and reject? The hole between “what” and “why” is the place regulatory
threat arises, and the EU AI
Act‘s Article
12 requires high-risk programs
to maintain automated logs for precisely this cause, so the “why” might be
reconstructed after the actual fact. Closing that hole is what agentic lineage
is for.

Agentic lineage

The best way to shut this audit hole is agentic lineage, an extension of
conventional knowledge lineage. The place conventional lineage tracks which sources have been
accessed, agentic lineage tracks why the agent determined to entry X, as a result of it
discovered Y in supply Z.

Concretely, for the commerce finance case, a single hint represents the
end-to-end workflow of processing letter of credit score LC-4892. Inside that hint,
every span is a person step:

• Span 1: retrieved buyer KYC knowledge from the compliance database, outcome:
  verified.
• Span 2: checked the sanctions record through the OFAC API, outcome: clear.
• Span 3: evaluated credit score phrases towards the coverage engine, outcome: inside
  limits.
• Last span: the choice, APPROVE, with a 94% confidence rating and the total
  reasoning chain hooked up.

That is precisely what a regulator wants. Not “the
agent accessed the compliance database at 14:32:07 UTC” however “the
agent checked KYC first, then sanctions, then credit score phrases, and
accredited as a result of all three handed.” The traces and spans
mannequin is borrowed straight from distributed programs
observability, so engineers already perceive the psychological mannequin from
instruments like Jaeger and Zipkin. For the agentic equal, Langfuse, Arize
Phoenix, and OpenTelemetry
for AI are the rising decisions. All three characteristic on the
Thoughtworks Expertise Radar, OpenTelemetry at Undertake, Langfuse at
Trial, and Arize Phoenix at Assess.

The regulatory enamel are actual

This is not a theoretical train. The EU AI Act is probably the most
particular regulation on the books. Article 12 requires
high-risk AI programs to routinely log occasions over their lifetime
so their operation might be traced, and Article
19 requires
suppliers to maintain these logs for at the least six months. Breaching
these record-keeping obligations falls within the Act’s center penalty
tier, as much as €15 million or 3% of worldwide annual turnover,
whichever is greater. For a big firm, even 3% of worldwide turnover
runs into the a whole bunch of thousands and thousands.

Collectively, Articles 12 and 19 translate into three obligations in your
structure:

• Mechanically log occasions throughout the system’s lifetime, sufficient to hint
  the way it operated, not simply remoted timestamps.
• Retain these logs for at the least six months, which suggests your
  observability infrastructure has to deal with long-term storage.
• Be capable to reconstruct the “why” after the actual fact. The legislation mandates the
  logs; making them reply a regulator’s query is on you. Meaning
  capturing the total reasoning chain, which sources have been consulted, what logic was
  utilized, and which alternate options the agent weighed and rejected.

The EU is furthest forward, and for now no different jurisdiction has a legislation fairly
prefer it. However you do not have to wager on the place regulation lands to see the purpose.
In the end one thing will pressure the query of why an agent did what it
did, whether or not that is a regulator, an auditor, a buyer disputing a call, or
simply your personal workforce attempting to debug one. The secure assumption is not {that a}
specific legislation is coming, it is that you’re going to wish to reply that query
regardless. A system you possibly can’t clarify is one you possibly can’t absolutely belief,
defend, or repair.

Staged autonomy

Figuring out you want audit trails is one factor; rolling this out safely is
one other. You do not deploy an agent with full autonomy on day one, any extra
than you’d hand a model new worker unrestricted entry. Autonomy is earned
in phases:

You would not give a brand new rent the company bank card on day one. They begin
with buy requests, graduate to supervised spending, and finally earn a
card with limits. Brokers ought to earn belief the identical manner.

Promotion up this ladder ought to activate proof, not a hunch. Meaning
testing an agent earlier than every step, not solely watching it in manufacturing. Brokers are
onerous to check. They’re nondeterministic, expensive to name, and act via instruments with
actual uncomfortable side effects. So groups mock or replay the software and mannequin interactions so assessments
run deterministically in CI. They rating the agent’s choices with evals moderately
than calling stay companies on each run. Constructing that harness is a self-discipline of
its personal, and past the scope of this text.

Delegated entry and just-in-time credentials

As brokers earn autonomy, the query turns into, what permissions ought to they maintain?
Three safety patterns matter most right here.

• Delegated Entry: When Alice asks the agent to test her account, the
  agent ought to act with Alice’s permissions, not via a broad service account
  that may see each buyer’s knowledge. Shared service accounts destroy attribution.
  When a regulator asks “who accessed this buyer’s knowledge?”, “the service
  account” tells you virtually nothing. With delegated entry, the reply is “Alice’s
  agent, appearing on Alice’s behalf, with Alice’s permissions.”
• Simply-in-time Credentials: As an alternative of a persistent API key that by no means
  expires, subject a short-lived token for every particular job. The agent must
  test the sanctions record? Difficulty a token scoped to OFAC API learn entry for
  that particular buyer, legitimate for 5 minutes. When the duty completes, the
  token expires. No standing credentials sitting round ready to be
  compromised.
• Least Privilege: The agent will get the minimal entry the duty requires.
  Processing a letter of credit score does not want attain into HR programs or advertising and marketing
  knowledge.

Collectively, these three patterns deal with the attribution and scope challenges
that undermine many present agentic deployments.

Additionally they defend towards the sharpest safety threat in agentic programs. Simon
Willison calls it the deadly
trifecta, an agent
turns harmful the second it holds all three of entry to non-public knowledge,
publicity to untrusted content material, and a technique to talk externally. Put these
collectively and a single poisoned doc or net web page can hijack the agent via
immediate injection and quietly exfiltrate no matter it might attain. Delegated entry,
just-in-time credentials, and least privilege shrink how a lot a hijacked agent
can attain, breaking the trifecta. Later we add a second reduce on the identical drawback,
protecting retrieved textual content out of the authorisation path solely, so {that a} poisoned
doc can not grant a permission within the first place.

The place to start out

Of the 4 subjects, that is the one the place going slowly is the appropriate
intuition. However separate two issues which can be simple to conflate. Autonomy is
earned in phases, so no person expects you to grant it .
Observability isn’t staged in any respect. It goes in from day one, at full
power, regardless of the autonomy stage, as a result of retrofitting it onto a
working system is painful. What you construct on prime can keep intentionally
conservative; the instrumentation beneath can not.

• Instrument from day one. Of every little thing right here, that is the one to do
  first, including observability after deployment is much tougher. Each agent workflow
  ought to emit traces with spans for every step, together with reasoning and sources
  consulted. The tracing sample right here is effectively established, so lean on a confirmed
  software (like
  OpenTelemetry)
  moderately than constructing your personal.
• Begin in shadow mode. Lowest threat, highest studying. Brokers
  advocate, people determine. You construct the audit path earlier than you want it for
  compliance and measure accuracy earlier than granting autonomy.
• Implement delegated entry. Brokers inherit the invoking consumer’s
  permissions and use just-in-time credentials with brief expiry home windows. No
  persistent tokens.
• Construct to be explainable. Whether or not or not a regulator ever asks, an
  audit path that solutions “why” is what allows you to debug a foul determination, defend a
  good one, and belief the system sufficient to widen its autonomy. Wire it in now,
  it is tougher so as to add later.

Semantic layers bridge the institutional information hole between brokers and
human analysts, constructing on trusted knowledge and auditable actions supplied by the
earlier subjects.

Your agent does not know what “income” means

Ask an agent, “What was Q3 income for Product X?” A human analyst is aware of
exactly what to do, which desk to question, whether or not income means gross or internet,
what Q3 maps to in your fiscal calendar. They absorbed all of it over years of
institutional information, tribal docs, and Slack threads.

The agent has none of it. It does not know which joins join merchandise to
orders to income, or that your fiscal calendar begins in February. With that
context lacking, it both hallucinates a solution or provides up. The semantic
layer fills that hole, supplying the business-domain context.

What the context layer is

A semantic layer is a set of declarative definitions of your metrics, how
income is calculated, what an energetic buyer is, what the numbers imply. Each
shopper goes via the identical definitions, so all of them derive constant,
correct outcomes. However an agent that acts wants greater than definitions of numbers.
It must know what the issues are, and what it might do to them. These are
three separate our bodies of definition, and an agent wants all three.

The area mannequin says what exists. Entities, their relationships, and
the which means guidelines of the enterprise: an order belongs to a buyer, an energetic
buyer is one who bought within the final ninety days. It provides the agent the
vocabulary to interpret a request and plan towards it. It’s consulted, by no means
executed; no question path to knowledge runs via it.

The semantic mannequin says how the numbers are computed. Metrics and
dimensions, one versioned formulation every, compiled to the identical SQL each time and
run towards the analytical retailer. That is the semantic layer underneath a extra actual
title, and the job is to place correctness within the compiler moderately than within the
mannequin’s guess.

The functionality mannequin says what the agent could do. A curated set of
operations towards stay programs, some that learn (test cost standing, retrieve
a troubleshooting information) and a few that write (subject a refund). Every carries
permissions and an proprietor, and the appearing ones carry preconditions and a
reversibility class as effectively.

Nouns, numbers, and verbs. Collectively they’re the context layer, and
what unites them isn’t that they’re all about which means, as a result of the potential
mannequin plainly isn’t. It’s that every one is a spot the place a assure is
declared as soon as, in model management, as an alternative of being labored out afresh by the
mannequin on each request. The definitions are the layer; the interface, MCP right this moment,
is simply the door.

A reader who works with dbt will object that its
semantic fashions already declare entities, so why
separate the area mannequin out. As a result of entities declared contained in the metrics layer
are scoped to metrics, and the potential mannequin needs to be written in the identical
vocabulary because the semantic one or the 2 drift aside. A refund acts on the identical
buyer the income determine counts. One vocabulary beneath, otherwise you get two.

Determine 2: The context layer: a site mannequin of entities and
relationships, a semantic mannequin of metrics compiled to SQL towards the analytical
retailer, and a functionality mannequin of guarded reads and actions towards stay programs,
with provenance alerts throughout all three. The area mannequin has no arrow out
as a result of it’s consulted moderately than executed; the opposite two are written in its
vocabulary. Dashboards and analysts attain the semantic mannequin; brokers are the primary
shopper to wish all three, which is the shift this text is about.

All three fashions are code in supply management. They undergo code opinions, get
examined in CI, and progress via environments earlier than reaching manufacturing. When
the definition of “income” or the rule on refunds modifications, you modify it in a single
place and it propagates in every single place. Brokers by no means attain the underlying knowledge
straight; they undergo the context layer, which constrains and governs each
what they will ask for and what they will do.

Metrics as code

In follow, the enterprise logic lives proper within the definition, income =
order_amount - discount_amount, not buried in a BI software or an advert hoc SQL view.
The agent receives a pure language query, and the semantic mannequin resolves
it to appropriate, constrained SQL. The agent does not guess desk names or be part of
paths; it makes use of the definition.

The examples right here use dbt
MetricFlow syntax (dbt is
mid-migration from measures to a metrics-first spec; the widely-used type is
proven right here, and the idea holds both manner). Dice.js, Snowflake, and
Databricks all comply with related patterns. The software issues lower than the
self-discipline of getting enterprise logic into model managed code.

semantic_models:
  - title: orders
    mannequin: ref('orders')
    defaults:
      agg_time_dimension: order_date
    entities:
      - title: order_id
        sort: main
      - title: customer_id
        sort: international
    dimensions:
      - title: order_date
        sort: time
        type_params:
          time_granularity: day
    measures:
      - title: income
        agg: sum
        expr: order_amount - discount_amount
        create_metric: true

Similar query, very completely different SQL

Let’s think about an instance. Ask “What was Q3 income for Product X?” of an agent
with out a semantic mannequin, and it guesses at desk names, makes use of the unsuitable
column, has no fiscal-calendar mapping, and misses the be part of.

-- Earlier than metric definition
SELECT SUM(quantity)
  FROM sales_data
 WHERE product = 'Product X'
   AND quarter = 'Q3'

Ask the identical query with a semantic mannequin, and the agent is constrained
to the proper desk, the net-revenue formulation from the YAML definition, the
proper fiscal-calendar dates, and the legitimate be part of path.

-- Constrained by metric definition
SELECT SUM(order_amount - discount_amount)
  FROM orders o
  JOIN merchandise p
    ON o.product_id = p.id
 WHERE p.title = 'Product X'
   AND o.order_date
       BETWEEN '2025-07-01'
           AND '2025-09-30'

The semantic mannequin does not make the agent smarter. It stops it from
guessing. For an agent that acts on the reply unchecked, that is what
issues.

How brokers use it

Take the semantic mannequin by itself, the trail a quantitative query travels.
Finish to finish, the stream seems to be like this. The agent sends a natural-language
query (step 1). The semantic mannequin seems to be up metric definitions, legitimate
dimensions, be part of paths, and entry guidelines, through MCP (step 2), then generates
constrained SQL (step 3), each inside the identical element. The information warehouse
executes the question (step 4). The outcome flows again to the agent with full
lineage metadata (step 5).

Determine 3: One of many three paths: a quantitative query
answered via the semantic mannequin. Questions on what issues are go to the
area mannequin, and reads or actions towards stay programs undergo the potential
mannequin.

The semantic mannequin constrains what the agent can ask for. dbt’s, for
occasion, dynamically surfaces solely the scale relevant to the chosen
metrics, which prevents the agent from producing believable sounding however
incorrect queries. And that lineage metadata in step 5 is the muse for the
traceability we lined earlier. Context and traceability reinforce one
one other.

The place to start out

The temptation with a context layer is to mannequin the entire enterprise earlier than
you ship something. Resist it. Begin with the semantic mannequin, as a result of the worth is
concentrated in a handful of metrics, the contested ones that imply completely different
issues to completely different groups. Let your first agent use case set the scope, and develop
the area mannequin and the capabilities it really wants moderately than those you
can think about. A slim, appropriate context layer beats a sprawling, half-agreed
one.

• 1. Discover your conflicting metric definitions. Most organizations have
  a number of definitions for his or her most essential metrics, income being the traditional,
  with its gross vs internet, with or with out returns variations. These conflicts are
  your largest agent threat and your quickest win.
• 2. Choose a software, however deal with the self-discipline. Any mainstream semantic
  layer software will do; what issues is the self-discipline behind it, metric definitions
  in model management, one agreed definition per metric, and brokers querying
  via the layer, not the uncooked schema.
• 3. Route brokers via the context layer, by no means the uncooked schema. The
  agent ought to see ruled metrics and dimensions, not uncooked tables and joins. MCP
  is the frequent technique to expose the layer right this moment, and dbt, Dice, and AtScale all ship
  MCP servers, however the precept holds nevertheless you join, the purpose is the
  abstraction, not the protocol.
• 4. Take a look at adversarially. One of the simplest ways to seek out gaps is adversarial testing,
  each hallucination factors to a lacking definition. Repair the definition, not the
  immediate. And do not boil the ocean, begin with the metrics your first agent use
  case wants.

Traversing the area mannequin: information graphs

The semantic mannequin shines for structured metric queries akin to “what was
income by area.” However some agent duties demand richer relationship reasoning
throughout entities, occasions, and time. Contemplate a buyer who purchased Product X, then
churned after a pricing change. A hard and fast variety of hops like that’s an bizarre
be part of. What flat tables deal with badly is traversal whose depth you do not know when
you write the question, following a series of relationships till you discover what you
are searching for. That’s the area mannequin’s territory, the entities and the way they
join.

The frequent technique to retailer and traverse that map is a information graph, which is a
storage selection for the area mannequin moderately than a fourth factor to construct.
GraphRAG from Microsoft makes use of neighborhood detection to
deal with summary queries that conventional RAG cannot, and
Graphiti builds temporally conscious information graphs
for evolving info. (Each sat at Trial on the Thoughtworks Radar as of
2026.) The semantic mannequin nonetheless defines the metrics; the graph carries the
connections between prospects, merchandise, occasions, and choices over time.
Collectively they provide brokers one thing near institutional reminiscence, the sort of
information that may take a brand new rent months to soak up.

Now brokers have trusted knowledge, governance, and context. However can they
really act?

Your agent can learn, however it might’t act

Let’s take an instance. An worker stories a PO (buy order) subject. An
supreme agent would do three issues, retrieve the related troubleshooting information,
test whether or not the PO cost service is down proper now, and create a
assist desk ticket if wanted.

Conventional RAG, the sample most organizations have deployed, solely does step
one. It searches paperwork and retrieves content material. It could actually’t question a stay
monitoring system to test service standing, and it definitely cannot create a
ticket in ServiceNow or Jira. That hole between searchable and actionable is
the topic of this remaining subject, and we are going to use the PO state of affairs to
elaborate.

The information entry spectrum

This framing comes from Microsoft’s Cloud
Adoption Framework for AI, which formalizes it as RAG + MCP-Learn +
MCP-Write.

1. Retrieval. RAG, vector search, doc lookup. The agent finds
   related content material. Most organizations stay right here right this moment.
2. Actual-Time Question. The agent queries stay programs,
   checks service standing, reads from databases in actual time.
3. Write-Again. Essentially the most highly effective and most harmful tier. The agent
   creates tickets, updates data, triggers workflows.

Every step up the spectrum provides functionality, and threat. The PO state of affairs maps
cleanly throughout all three.

• Retrieve the information (Retrieval)
• Verify cost standing (Actual-Time Question)
• Create the ticket (Write-Again)

The shift to agentic AI requires all three, not simply the retrieval
most groups have constructed.

MCP has rapidly change into the default technique to wire these tiers up, and its rise
has been remarkably quick. However the mechanism issues lower than the demarcation.
What counts is protecting retrieval, real-time reads, and write-back as separate,
intentionally ruled ranges of entry, whether or not you expose them via MCP or
your personal native APIs.

Three primitives, one protocol

Brokers attain all of this via MCP, the Mannequin Context Protocol. Its
primitives sit on a threat gradient, Sources (read-only) are secure, Prompts form
habits, and Instruments change state. That gradient maps straight onto the tiers,
Sources to retrieval and Instruments to write-back, which is why the secure path is to
expose Sources first and graduate to Instruments solely underneath governance. Within the PO
state of affairs, Sources serve the troubleshooting docs, a Immediate guides triage, and
Instruments run check_service_status() and create_support_ticket().

Antipattern: naive API-to-MCP conversion

The way you design these Instruments issues as a lot as if you attain for them. The
frequent, expensive mistake is to take present REST APIs and wrap them one-to-one,
so each endpoint turns into a software. The result’s software sprawl, 50 instruments with
names like get_po_payment_status, create_ticket_po_payment,
create_ticket_po_payment_network. The agent then has to decide on amongst 50
barely-distinguished instruments with little context, and LLMs are dangerous at that;
accuracy drops sharply because the software depend climbs. The Thoughtworks Tech Radar put
“naive API-to-MCP
conversion”
on HOLD for precisely this cause.

The higher strategy exposes the identical performance as a handful of
well-designed capabilities with wealthy descriptions and parameterized inputs.
check_service_status takes a service title and site, one software for all
companies and all areas. create_support_ticket is parameterized with
class, precedence, and outline. The descriptions are detailed sufficient for
the LLM to know when to succeed in for every one.

The precept is to design capabilities, not endpoints. 5 to 10 effectively
described enterprise capabilities will outperform 50 skinny API wrappers virtually
each time. And this precept is protocol-agnostic, whether or not an agent reaches
your knowledge via MCP, via one other agent, or via no matter customary comes
subsequent, the properties that make it agent-ready are the identical, wealthy descriptions,
parameterized entry, clear schemas.

What a functionality declares

A wealthy description tells the agent when to succeed in for a functionality. It says
nothing about whether or not the agent is allowed to, or what occurs whether it is unsuitable.
That’s the remainder of the declaration. Each functionality carries
permissions, who could invoke it and appearing as whom, and an proprietor,
the individual accountable when it misbehaves. Those that act carry two extra.

Preconditions are the situations that should maintain earlier than the motion could
proceed, checked towards stay state in the meanwhile of appearing moderately than towards
regardless of the agent learn earlier in its plan. A refund wants an authentic cost,
not but refunded, throughout the quantity the invoking consumer could authorise.

Reversibility is the category of harm the motion can do: cleanly
reversible, reversible at a value via some compensating transaction, or
irreversible. That is the extra helpful predictor of secure autonomy than the cash
concerned. A $50,000 inner ledger correction you possibly can again out is a safer factor
to automate than a $200 cost to an exterior account you can’t claw again. The place
the staged autonomy ladder earlier keys its guardrails to transaction dimension, want
keying them to reversibility, and let irreversible actions require human approval
no matter stage the agent has reached.

Which raises the query of the place the principles in these preconditions come from,
as a result of most of them are written down in prose someplace, in a refund coverage, a
contract, a compliance guide.

Retrieved textual content informs, it by no means gates

Enterprise paperwork stay the place the enterprise writes its guidelines down. However a rule
that gates an motion should not be learn and interpreted in the meanwhile of appearing.
Guidelines are extracted from these paperwork forward of time, curated by a human, and
saved as declared preconditions within the functionality mannequin, every with a hyperlink again
to the passage it got here from.

At motion time the agent should still learn unstructured content material, a criticism
ticket, a contract clause, to work out what to suggest. Solely the declared guidelines
determine what’s permitted, and they’re checked deterministically towards stay
state. The boundary is between informing and gating. Retrieved textual content
can form what the agent suggests and function proof for a human approver, however
it by no means carries the authority to authorise the motion itself.

That boundary can be a safety property. Eradicating retrieved textual content from the
authorisation path means a poisoned doc can not grant an agent a permission
it didn’t have already got, which is a stronger declare than merely shrinking what a
hijacked agent can attain. It’s not an entire defence, as a result of injected textual content can
nonetheless affect what the agent proposes, and a human approver proven fabricated
proof could wave it via. What it removes is the trail the place the doc
authorises the motion straight, with no person in between.

The provenance hyperlink is what retains the declarations trustworthy because the paperwork
transfer beneath them. Watch out what you promise right here. Detecting {that a} doc
modified is straightforward; realizing that the change invalidated a precondition derived from
it’s a judgement, not a diff. What the hyperlink buys you is a assessment queue, the
derived guidelines flagged for a human to re-check when their supply strikes, within the
identical spirit as keying a freshness SLA to when the index was final rebuilt moderately
than to when the content material final appeared to alter.

The place no declaration covers the scenario, the agent doesn’t improvise from
its personal studying of coverage. It escalates. That is the onerous gate from earlier in a
completely different setting, the identical intuition that claims any contract or SLA breach forces
a human moderately than a decrease rating. An undeclared case degrades the agent to
supervised, to not autonomous.

Extraction and curation is a pipeline like another, and it wants an proprietor,
a cadence, and any individual who clears the assessment queue. Which is the topic of a
later part, as a result of none of this maintains itself.

Finish to finish: the PO cost state of affairs

With all three tiers in place, the PO subject we opened the part with runs
finish to finish, the agent retrieves the troubleshooting information (a read-only
Useful resource), checks the stay cost standing (a Instrument that reads), and information a
ticket (a Instrument that writes), all in a single workflow.

Determine 4:
One agent, three tiers: retrieval, real-time question, then write-back,
mixed right into a single response.

Accomplished manually, the worker would wait in a queue, clarify the problem, have a
assist agent test the monitoring dashboard, and get a ticket created. The
agent is now capable of do all this in a single move.

The place to start out

The secure manner in is to climb the tiers, not leap to write-back. Most groups
already stay in retrieval, the read-only tier the place threat is lowest. Write-back
is the place the true hazard sits. So earn your manner up. Map what every use case
wants, expose read-only entry first, and add write-back final, solely
as soon as you possibly can log each motion. Do not let the fun of an agent that may act
rush you previous the steps that make appearing secure.

• 1. Map your knowledge entry tiers. Take your prime three agent use circumstances and
  classify what every wants, retrieval, real-time question, or
  write-back. Most gaps stay in real-time question and write-back.
• 2. Design capabilities, not endpoints. Group present APIs into 5–10
  well-described enterprise capabilities. Wealthy descriptions matter, they’re what the
  LLM makes use of to determine which software to name.
• 3. Begin with MCP Sources. Learn-only entry is the bottom threat entry
  level. Expose information bases, config knowledge, and documentation as Sources.
  Graduate to Instruments solely as soon as governance is in place.
• 4. Instrument from day one. Earlier than deploying any agent with write
  entry, log each software invocation, who triggered it, what was referred to as, when, and
  critically, on whose behalf. This feeds the audit path from the Traceability
  and Governance part.