Making Your Information Prepared for Agentic AI

Brokers deal with each worth as reality

Take into account a concrete situation. A pricing agent is requested for the
present worth of Product X. Yesterday, the worth was up to date from
$49.99 to $59.99. However the agent’s knowledge supply hasn’t refreshed, it
nonetheless exhibits the previous quantity.

The agent would not hesitate, it retrieves $49.99, quotes the
buyer, the shopper buys, and the corporate loses $10 on each unit
bought. Each step the agent took was technically appropriate. It adopted
its workflow completely. The knowledge it accessed was the
downside.

A human gross sales rep would have paused: “Wait, did not we replace this
final week?” They’d double-check. They’ve institutional reminiscence and a
really feel for when one thing’s off. The agent has neither. Errors do not
set off warnings; they cascade silently by the workflow. And
this is not a uncommon edge case. Within the 2026 State
of Information Integrity and AI Readiness report, Exactly and Drexel
College’s LeBow School of Enterprise surveyed 505 knowledge and analytics
leaders, of whom 87% believed their knowledge was prepared for AI, but 43% named
knowledge readiness as the one largest barrier to getting worth from it. That
hole between confidence and readiness is the organization-level model
of the pricing agent, certain of itself and improper. A separate KPMG World AI Pulse survey of two,145 leaders factors the
identical method, with almost half of executives now seeing AI’s prices exceed its
advantages. Most enterprises are one stale area away from the situation
above.

Schema is legislation: knowledge contracts as code

So how do you forestall AI brokers from accessing dangerous or stale
knowledge? The reply is knowledge contracts, treating schema as legislation,
not a well mannered suggestion.

This reverses a decade of “schemaless is versatile” considering,
for human customers, free schemas are merely inconvenient, whereas
for AI brokers, they’re harmful. An information contract, written within the
Open Information Contract
Normal,
the format the Information Contract CLI
makes use of (and advisable in Thoughtworks tech radar
33),
defines the foundations explicitly. A product_pricing contract may
specify:

• Properties with strict logical sorts.
• A top quality rule that worth should be better than zero.
• A top quality test on foreign money that rejects something exterior USD, EUR, or
  GBP.
• Critically, a freshness SLA, pricing knowledge will need to have been refreshed
  inside the final 24 hours.

Within the Open Information Contract Normal, that contract is proven
under.

apiVersion: v3.1.0
sort: DataContract
id: product-pricing
title: Product Pricing
model: 1.0.0
standing: lively
schema:
  - title: product_pricing
    physicalType: desk
    properties:
      - title: product_id
        logicalType: string
        physicalType: varchar(64)
        required: true
        distinctive: true
        primaryKey: true
        primaryKeyPosition: 1
      - title: worth
        logicalType: quantity
        physicalType: decimal
        required: true
        high quality:
          - sort: sql
            description: Each worth should be better than zero
            question: SELECT min({property}) FROM {object}
            mustBeGreaterThan: 0
      - title: foreign money
        logicalType: string
        physicalType: varchar(3)
        required: true
        high quality:
          - sort: sql
            description: Forex should be a supported ISO code
            question: SELECT depend(*) FROM {object} WHERE {property} NOT IN ('USD', 'EUR', 'GBP')
            mustBe: 0
      - title: ingested_at
        logicalType: timestamp
        physicalType: timestamp
        required: true
slaProperties:
  # the rule that might have caught the stale-price situation
  - property: latency
    worth: 24
    unit: h
    component: product_pricing.ingested_at

Enforcement occurs alongside three dimensions.

• Schema enforcement ensures sorts and constraints are revered and made
  express by the contract.
• Freshness SLAs outline the utmost acceptable staleness per dataset,
  nightly batch updates aren’t sufficient when an agent solutions in actual time.
  Key the SLA to when the info was final efficiently loaded, not when a worth final
  modified, in order that regular knowledge is not flagged as stale and a stalled pipeline cannot
  masquerade as recent.
• High quality gates validate contracts in CI/CD, blocking deployments when
  they fail.

Discover how this adjustments the sooner pricing situation, it
prevents it by design. If the pricing knowledge hasn’t been refreshed
in 24 hours, the contract is violated earlier than the agent ever sees
the info.

The quarantine sample

Defining a contract is one factor. What occurs when knowledge
violates it? You want a circuit breaker and that is the
quarantine sample.

The circulation works like this. Uncooked knowledge arrives from supply
techniques, APIs, databases, streams. Earlier than it enters the agent
accessible knowledge retailer, it passes by a contract validation
gate that checks three issues, does it match the schema, is it
inside the freshness SLA, and does it cross the standard
guidelines?

If it passes all three, it flows into the licensed, agent
prepared tier. If it fails any one in all them, it is quarantined,
routed to a lifeless letter queue for human assessment, with alerts
fired.

The purpose is that the agent by no means sees the dangerous knowledge. It
would not get poisoned by stale costs or corrupted embeddings. In
the pricing situation, if the ingested_at timestamp is older
than 24 hours the contract is violated and the report is
quarantined, so when requested concerning the worth the agent says, “I
haven’t got present pricing knowledge” slightly than confidently quoting
the improper quantity. That could be a much better failure mode. And it is a job
for the info structure, not the mannequin. A greater mannequin will not rescue
you from dangerous knowledge.

Medallion structure for brokers

A medallion structure is an analytical knowledge design sample for
organizing knowledge in a lakehouse,
popularized by Databricks.

Unhealthy knowledge will get quarantined, however the place does the good knowledge go?
That is what the medallion structure organizes, and its first three
tiers are properly established:

• Bronze: uncooked, immutable ingestion. You retain the whole lot for audit path
  and lineage.
• Silver: validated and deduplicated. Schema is utilized, knowledge contracts
  are enforced, and that is the place the quarantine sample lives.
• Gold: licensed. That is what the semantic mannequin compiles towards,
  entry is ruled, and metrics are trusted.

For agentic architectures, there is a helpful fourth tier value
including: Adaptive Gold the place brokers turn out to be lively
members in knowledge curation slightly than passive customers (proven
within the determine under). They monitor their very own question patterns,
establish often accessed combos, and materialize optimized
datasets, successfully constructing their very own warehouse views primarily based on
actual utilization. The concept brokers can actively curate knowledge, slightly
than solely learn it, is already in manufacturing, at DataHub’s CONTEXT 2025 summit, Apple
described brokers performing as “digital stewards” of its knowledge catalog,
repeatedly scanning metadata, flagging gaps, and proposing
updates, turning passive documentation into an lively governance
companion. Apple’s brokers curate the catalog; Adaptive Gold factors
that very same active-curation sample on the datasets themselves. That
final step is an extrapolation, however a modest one from one thing
already working.

Determine 1: Medallion tiers for brokers:
knowledge flows from uncooked Bronze by validated Silver to licensed
Gold and agent curated Adaptive Gold, whereas brokers are restricted to
Gold and above.

The important thing architectural precept is that brokers ought to solely
entry Gold tier or above. Bronze and Silver exist for
lineage, debugging, and human investigation. Exposing uncooked or
partially validated knowledge to brokers invitations the
pricing downside again in.

The identical guidelines for unstructured knowledge

Every little thing to this point has appeared like a desk, costs, currencies,
timestamps, however most of what brokers devour is not tabular. It is
paperwork, wikis, PDFs, and help tickets, chunked and embedded
right into a vector retailer for retrieval. In case your brokers do RAG, that is
the info they run on, and it wants the identical belief ensures, even
although you may’t write worth > 0 on a paragraph. The patterns
carry over, solely the standard dimensions change.

The stale-price situation has a twin right here. A coverage doc will get
up to date, however the vector index is not re-embedded, so the agent
retrieves the previous model and solutions confidently from it, the identical
failure because the stale worth, solely now it is an embedding slightly than a
row. The freshness SLA carries over, however be exact about what
the clock measures, the purpose is not when the content material final modified,
it is when the index was final efficiently rebuilt towards its
sources. A 24-hour SLA means the re-indexing job will need to have accomplished
inside the final 24 hours, if it hasn’t, the index is stale and
quarantined even when nothing seems to have modified, as a result of a
silently failed indexer is precisely when you may’t inform whether or not
one thing did. That one heartbeat catches each the up to date however
unindexed doc and the pipeline that quietly stopped.

Contracts transfer from the content material to the encircling metadata.
You’ll be able to’t constrain the prose, however you may require that each chunk
carry a supply, a model, a timestamp, and an entry scope, and
reject something that does not. That metadata can be what makes
retrieval traceable and governable later.

High quality gates get checks suited to textual content, reject empty or
truncated chunks, catch near-duplicate paperwork that skew
retrieval, flag failed extractions and OCR rubbish, and look ahead to
embedding drift. A malformed or empty embedding warps similarity
search, so it by no means reaches the shop, for a similar purpose a foul
worth by no means reaches the agent, a warped index makes the agent
retrieve confidently improper content material.

Whether or not the info is a priced row or an embedded paragraph, the
job is equivalent. The structure has to scent what’s dangerous earlier than
the agent does.

Confidence-threshold routing

Contracts, quarantine, and the medallion structure deal with the
clear instances. However there is a grey space, knowledge that is not clearly dangerous,
however is not absolutely reliable both. That is the place
confidence-threshold routing is available in, bridging full autonomy
and full human management.

The agent processes a request and assesses knowledge high quality alerts,
and checks not simply mannequin confidence, however data-level alerts
like freshness, completeness, and consistency. If confidence is at
or above the brink (say 85%), the agent proceeds autonomously.
Under it, the agent defers to a human. The edge is configurable
per use case, for instance, pricing may demand 90%, whereas an
inside FAQ is ok at 70%.

Let’s return to the pricing situation one final time. The worth
knowledge is three days stale; the freshness SLA says 24 hours. The SLA
violation robotically drives the arrogance rating under the
threshold, no matter how assured the mannequin itself feels about
its reply. The agent ought to reply by pulling a human in:

“I am not assured this worth is present. Routing to a human for
verification.”

In different phrases, knowledge high quality alerts ought to drive the
threshold, not simply the mannequin’s personal confidence. A mannequin may be
certain of a stale reply, and the freshness SLA overrides that
misplaced certainty.

The laborious half is popping these high quality alerts right into a single
rating and weighing it towards the mannequin’s personal confidence. That is an
open design downside, not a solved one. Begin with a tough gate slightly
than a easy composite. Any contract or SLA breach forces a human,
no matter how the opposite alerts look. Add weighted scoring later,
and solely as soon as you may present it beats that easy rule.

The place to start out

You do not have to construct all of this without delay, and most groups
cannot. Contracts, quarantine gates, a medallion structure, and
confidence-threshold routing are so much to face up in a single go. The
excellent news is that they are additive, every one lowers threat by itself,
and you’ll layer in the remaining over time. Start with the best
leverage strikes and develop from there.

1. Outline freshness SLAs for each dataset brokers contact. The identical
   dataset can have completely different freshness necessities per client, comparable to a
   pricing desk that is fantastic on nightly batches for a dashboard might have close to actual
   time updates when a quoting agent relies on it.
2. Implement quarantine gates. Validate towards contracts earlier than knowledge
   enters agent accessible storage. Begin together with your highest threat datasets comparable to
   pricing, stock, buyer information.
3. Begin with the Information Contract CLI. Convey contract governance into
   CI/CD, outline contracts as YAML, validate robotically, block deployments on
   failure. Deal with knowledge contracts with the identical rigor you’d give an API
   contract.
4. Add confidence threshold routing. When high quality alerts drop under a
   threshold, defer to a human. Begin excessive (round 90%) and regulate downward as you
   construct belief and observe accuracy.

We have made knowledge reliable. However when brokers act autonomously on that knowledge,
who’s watching?

The audit hole

Image a financial institution working agentic AI for commerce finance, the place the governance
structure is the true innovation.

An agent processes a letter of credit score. It checks KYC knowledge, verifies the
buyer is not on a sanctions checklist, evaluates the credit score phrases, and approves a
$2.4 million transaction, all in about 30 seconds. Six months later, a regulator
asks a easy query, “Why was this accepted?”

Conventional audit logs can inform you what occurred, which tables have been
queried, at what time, by which service account. What they can not inform you is
why. Why did the agent test the sanctions checklist earlier than the credit score phrases? Why
did it approve regardless of a minor documentation discrepancy? What options did
it contemplate and reject? The hole between “what” and “why” is the place regulatory
threat arises, and the EU AI
Act‘s Article
12 requires high-risk techniques
to maintain computerized logs for precisely this purpose, so the “why” may be
reconstructed after the actual fact. Closing that hole is what agentic lineage
is for.

Agentic lineage

The best way to shut this audit hole is agentic lineage, an extension of
conventional knowledge lineage. The place conventional lineage tracks which sources have been
accessed, agentic lineage tracks why the agent determined to entry X, as a result of it
discovered Y in supply Z.

Concretely, for the commerce finance case, a single hint represents the
end-to-end workflow of processing letter of credit score LC-4892. Inside that hint,
every span is a person step:

• Span 1: retrieved buyer KYC knowledge from the compliance database, consequence:
  verified.
• Span 2: checked the sanctions checklist through the OFAC API, consequence: clear.
• Span 3: evaluated credit score phrases towards the coverage engine, consequence: inside
  limits.
• Ultimate span: the choice, APPROVE, with a 94% confidence rating and the complete
  reasoning chain hooked up.

That is precisely what a regulator wants. Not “the
agent accessed the compliance database at 14:32:07 UTC” however “the
agent checked KYC first, then sanctions, then credit score phrases, and
accepted as a result of all three handed.” The traces and spans
mannequin is borrowed immediately from distributed techniques
observability, so engineers already perceive the psychological mannequin from
instruments like Jaeger and Zipkin. For the agentic equal, Langfuse, Arize
Phoenix, and OpenTelemetry
for AI are the rising selections. All three function on the
Thoughtworks Know-how Radar, OpenTelemetry at Undertake, Langfuse at
Trial, and Arize Phoenix at Assess.

The regulatory tooth are actual

This is not a theoretical train. The EU AI Act is essentially the most
particular regulation on the books. Article 12 requires
high-risk AI techniques to robotically log occasions over their lifetime
so their operation may be traced, and Article
19 requires
suppliers to maintain these logs for no less than six months. Breaching
these record-keeping obligations falls within the Act’s center penalty
tier, as much as €15 million or 3% of worldwide annual turnover,
whichever is greater. For a big firm, even 3% of worldwide turnover
runs into the a whole lot of hundreds of thousands.

Collectively, Articles 12 and 19 translate into three obligations to your
structure:

• Robotically log occasions throughout the system’s lifetime, sufficient to hint
  the way it operated, not simply remoted timestamps.
• Retain these logs for no less than six months, which implies your
  observability infrastructure has to deal with long-term storage.
• Have the ability to reconstruct the “why” after the actual fact. The legislation mandates the
  logs; making them reply a regulator’s query is on you. Meaning
  capturing the complete reasoning chain, which sources have been consulted, what logic was
  utilized, and which options the agent weighed and rejected.

The EU is furthest forward, and for now no different jurisdiction has a legislation fairly
prefer it. However you do not have to guess on the place regulation lands to see the purpose.
Ultimately one thing will drive the query of why an agent did what it
did, whether or not that is a regulator, an auditor, a buyer disputing a call, or
simply your personal workforce attempting to debug one. The protected assumption is not {that a}
explicit legislation is coming, it is that you will need to reply that query
regardless. A system you may’t clarify is one you may’t absolutely belief,
defend, or repair.

Staged autonomy

Understanding you want audit trails is one factor; rolling this out safely is
one other. You do not deploy an agent with full autonomy on day one, any extra
than you’d hand a model new worker unrestricted entry. Autonomy is earned
in levels:

You would not give a brand new rent the company bank card on day one. They begin
with buy requests, graduate to supervised spending, and finally earn a
card with limits. Brokers ought to earn belief the identical method.

Promotion up this ladder ought to activate proof, not a hunch. Meaning
testing an agent earlier than every step, not solely watching it in manufacturing. Brokers are
laborious to check. They’re nondeterministic, pricey to name, and act by instruments with
actual unwanted effects. So groups mock or replay the device and mannequin interactions so checks
run deterministically in CI. They rating the agent’s choices with evals slightly
than calling reside providers on each run. Constructing that harness is a self-discipline of
its personal, and past the scope of this text.

Delegated entry and just-in-time credentials

As brokers earn autonomy, the query turns into, what permissions ought to they maintain?
Three safety patterns matter most right here.

• Delegated Entry: When Alice asks the agent to test her account, the
  agent ought to act with Alice’s permissions, not by a broad service account
  that may see each buyer’s knowledge. Shared service accounts destroy attribution.
  When a regulator asks “who accessed this buyer’s knowledge?”, “the service
  account” tells you nearly nothing. With delegated entry, the reply is “Alice’s
  agent, performing on Alice’s behalf, with Alice’s permissions.”
• Simply-in-time Credentials: As an alternative of a persistent API key that by no means
  expires, situation a short-lived token for every particular activity. The agent must
  test the sanctions checklist? Situation a token scoped to OFAC API learn entry for
  that particular buyer, legitimate for 5 minutes. When the duty completes, the
  token expires. No standing credentials sitting round ready to be
  compromised.
• Least Privilege: The agent will get the minimal entry the duty requires.
  Processing a letter of credit score would not want attain into HR techniques or advertising and marketing
  knowledge.

Collectively, these three patterns handle the attribution and scope challenges
that undermine many present agentic deployments.

Additionally they defend towards the sharpest safety threat in agentic techniques. Simon
Willison calls it the deadly
trifecta, an agent
turns harmful the second it holds all three of entry to non-public knowledge,
publicity to untrusted content material, and a technique to talk externally. Put these
collectively and a single poisoned doc or net web page can hijack the agent by
immediate injection and quietly exfiltrate no matter it will possibly attain. Delegated entry,
just-in-time credentials, and least privilege shrink how a lot a hijacked agent
can attain, breaking the trifecta. Later we add a second reduce on the identical downside,
protecting retrieved textual content out of the authorisation path completely, so {that a} poisoned
doc can’t grant a permission within the first place.

The place to start out

Of the 4 subjects, that is the one the place going slowly is the precise
intuition. However separate two issues which are straightforward to conflate. Autonomy is
earned in levels, so no one expects you to grant it abruptly.
Observability will not be staged in any respect. It goes in from day one, at full
energy, regardless of the autonomy stage, as a result of retrofitting it onto a
working system is painful. What you construct on high can keep intentionally
conservative; the instrumentation beneath can’t.

• Instrument from day one. Of the whole lot right here, that is the one to do
  first, including observability after deployment is much tougher. Each agent workflow
  ought to emit traces with spans for every step, together with reasoning and sources
  consulted. The tracing sample right here is properly established, so lean on a confirmed
  device (like
  OpenTelemetry)
  slightly than constructing your personal.
• Begin in shadow mode. Lowest threat, highest studying. Brokers
  advocate, people resolve. You construct the audit path earlier than you want it for
  compliance and measure accuracy earlier than granting autonomy.
• Implement delegated entry. Brokers inherit the invoking person’s
  permissions and use just-in-time credentials with quick expiry home windows. No
  persistent tokens.
• Construct to be explainable. Whether or not or not a regulator ever asks, an
  audit path that solutions “why” is what permits you to debug a foul choice, defend a
  good one, and belief the system sufficient to widen its autonomy. Wire it in now,
  it is tougher so as to add later.

Semantic layers bridge the institutional information hole between brokers and
human analysts, constructing on trusted knowledge and auditable actions supplied by the
earlier subjects.

Your agent would not know what “income” means

Ask an agent, “What was Q3 income for Product X?” A human analyst is aware of
exactly what to do, which desk to question, whether or not income means gross or internet,
what Q3 maps to in your fiscal calendar. They absorbed all of it over years of
institutional information, tribal docs, and Slack threads.

The agent has none of it. It would not know which joins join merchandise to
orders to income, or that your fiscal calendar begins in February. With that
context lacking, it both hallucinates a solution or offers up. The semantic
layer fills that hole, supplying the business-domain context.

What the context layer is

A semantic layer is a set of declarative definitions of your metrics, how
income is calculated, what an lively buyer is, what the numbers imply. Each
client goes by the identical definitions, so all of them derive constant,
correct outcomes. However an agent that acts wants greater than definitions of numbers.
It must know what the issues are, and what it could do to them. These are
three separate our bodies of definition, and an agent wants all three.

The area mannequin says what exists. Entities, their relationships, and
the that means guidelines of the enterprise: an order belongs to a buyer, an lively
buyer is one who bought within the final ninety days. It offers the agent the
vocabulary to interpret a request and plan towards it. It’s consulted, by no means
executed; no question path to knowledge runs by it.

The semantic mannequin says how the numbers are computed. Metrics and
dimensions, one versioned method every, compiled to the identical SQL each time and
run towards the analytical retailer. That is the semantic layer beneath a extra precise
title, and the job is to place correctness within the compiler slightly than within the
mannequin’s guess.

The functionality mannequin says what the agent might do. A curated set of
operations towards reside techniques, some that learn (test fee standing, retrieve
a troubleshooting information) and a few that write (situation a refund). Every carries
permissions and an proprietor, and the performing ones carry preconditions and a
reversibility class as properly.

Nouns, numbers, and verbs. Collectively they’re the context layer, and
what unites them will not be that they’re all about that means, as a result of the aptitude
mannequin plainly will not be. It’s that every one is a spot the place a assure is
declared as soon as, in model management, as an alternative of being labored out afresh by the
mannequin on each request. The definitions are the layer; the interface, MCP right this moment,
is simply the door.

A reader who works with dbt will object that its
semantic fashions already declare entities, so why
separate the area mannequin out. As a result of entities declared contained in the metrics layer
are scoped to metrics, and the aptitude mannequin must be written in the identical
vocabulary because the semantic one or the 2 drift aside. A refund acts on the identical
buyer the income determine counts. One vocabulary beneath, otherwise you get two.

Determine 2: The context layer: a site mannequin of entities and
relationships, a semantic mannequin of metrics compiled to SQL towards the analytical
retailer, and a functionality mannequin of guarded reads and actions towards reside techniques,
with provenance alerts throughout all three. The area mannequin has no arrow out
as a result of it’s consulted slightly than executed; the opposite two are written in its
vocabulary. Dashboards and analysts attain the semantic mannequin; brokers are the primary
client to wish all three, which is the shift this text is about.

All three fashions are code in supply management. They undergo code opinions, get
examined in CI, and progress by environments earlier than reaching manufacturing. When
the definition of “income” or the rule on refunds adjustments, you modify it in a single
place and it propagates all over the place. Brokers by no means attain the underlying knowledge
immediately; they undergo the context layer, which constrains and governs each
what they’ll ask for and what they’ll do.

Metrics as code

In observe, the enterprise logic lives proper within the definition, income =
order_amount - discount_amount, not buried in a BI device or an advert hoc SQL view.
The agent receives a pure language query, and the semantic mannequin resolves
it to appropriate, constrained SQL. The agent would not guess desk names or be part of
paths; it makes use of the definition.

The examples right here use dbt
MetricFlow syntax (dbt is
mid-migration from measures to a metrics-first spec; the widely-used type is
proven right here, and the idea holds both method). Dice.js, Snowflake, and
Databricks all comply with related patterns. The device issues lower than the
self-discipline of getting enterprise logic into model managed code.

semantic_models:
  - title: orders
    mannequin: ref('orders')
    defaults:
      agg_time_dimension: order_date
    entities:
      - title: order_id
        sort: major
      - title: customer_id
        sort: international
    dimensions:
      - title: order_date
        sort: time
        type_params:
          time_granularity: day
    measures:
      - title: income
        agg: sum
        expr: order_amount - discount_amount
        create_metric: true

Similar query, very completely different SQL

Let’s contemplate an instance. Ask “What was Q3 income for Product X?” of an agent
with out a semantic mannequin, and it guesses at desk names, makes use of the improper
column, has no fiscal-calendar mapping, and misses the be part of.

-- Earlier than metric definition
SELECT SUM(quantity)
  FROM sales_data
 WHERE product = 'Product X'
   AND quarter = 'Q3'

Ask the identical query with a semantic mannequin, and the agent is constrained
to the right desk, the net-revenue method from the YAML definition, the
proper fiscal-calendar dates, and the legitimate be part of path.

-- Constrained by metric definition
SELECT SUM(order_amount - discount_amount)
  FROM orders o
  JOIN merchandise p
    ON o.product_id = p.id
 WHERE p.title = 'Product X'
   AND o.order_date
       BETWEEN '2025-07-01'
           AND '2025-09-30'

The semantic mannequin would not make the agent smarter. It stops it from
guessing. For an agent that acts on the reply unchecked, that is what
issues.

How brokers use it

Take the semantic mannequin by itself, the trail a quantitative query travels.
Finish to finish, the circulation seems to be like this. The agent sends a natural-language
query (step 1). The semantic mannequin seems to be up metric definitions, legitimate
dimensions, be part of paths, and entry guidelines, through MCP (step 2), then generates
constrained SQL (step 3), each inside the identical element. The information warehouse
executes the question (step 4). The consequence flows again to the agent with full
lineage metadata (step 5).

Determine 3: One of many three paths: a quantitative query
answered by the semantic mannequin. Questions on what issues are go to the
area mannequin, and reads or actions towards reside techniques undergo the aptitude
mannequin.

The semantic mannequin constrains what the agent can ask for. dbt’s, for
occasion, dynamically surfaces solely the size relevant to the chosen
metrics, which prevents the agent from producing believable sounding however
incorrect queries. And that lineage metadata in step 5 is the muse for the
traceability we lined earlier. Context and traceability reinforce one
one other.

The place to start out

The temptation with a context layer is to mannequin the entire enterprise earlier than
you ship something. Resist it. Begin with the semantic mannequin, as a result of the worth is
concentrated in a handful of metrics, the contested ones that imply completely different
issues to completely different groups. Let your first agent use case set the scope, and develop
the area mannequin and the capabilities it really wants slightly than those you
can think about. A slim, appropriate context layer beats a sprawling, half-agreed
one.

• 1. Discover your conflicting metric definitions. Most organizations have
  a number of definitions for his or her most vital metrics, income being the traditional,
  with its gross vs internet, with or with out returns variations. These conflicts are
  your largest agent threat and your quickest win.
• 2. Choose a device, however deal with the self-discipline. Any mainstream semantic
  layer device will do; what issues is the self-discipline behind it, metric definitions
  in model management, one agreed definition per metric, and brokers querying
  by the layer, not the uncooked schema.
• 3. Route brokers by the context layer, by no means the uncooked schema. The
  agent ought to see ruled metrics and dimensions, not uncooked tables and joins. MCP
  is the frequent technique to expose the layer right this moment, and dbt, Dice, and AtScale all ship
  MCP servers, however the precept holds nevertheless you join, the purpose is the
  abstraction, not the protocol.
• 4. Check adversarially. One of the simplest ways to seek out gaps is adversarial testing,
  each hallucination factors to a lacking definition. Repair the definition, not the
  immediate. And do not boil the ocean, begin with the metrics your first agent use
  case wants.

Traversing the area mannequin: information graphs

The semantic mannequin shines for structured metric queries comparable to “what was
income by area.” However some agent duties demand richer relationship reasoning
throughout entities, occasions, and time. Take into account a buyer who purchased Product X, then
churned after a pricing change. A set variety of hops like that’s an bizarre
be part of. What flat tables deal with badly is traversal whose depth you do not know when
you write the question, following a series of relationships till you discover what you
are searching for. That’s the area mannequin’s territory, the entities and the way they
join.

The frequent technique to retailer and traverse that map is a information graph, which is a
storage selection for the area mannequin slightly than a fourth factor to construct.
GraphRAG from Microsoft makes use of group detection to
deal with summary queries that conventional RAG cannot, and
Graphiti builds temporally conscious information graphs
for evolving information. (Each sat at Trial on the Thoughtworks Radar as of
2026.) The semantic mannequin nonetheless defines the metrics; the graph carries the
connections between prospects, merchandise, occasions, and choices over time.
Collectively they provide brokers one thing near institutional reminiscence, the sort of
information that might take a brand new rent months to soak up.

Now brokers have trusted knowledge, governance, and context. However can they
really act?

Your agent can learn, however it will possibly’t act

Let’s take an instance. An worker experiences a PO (buy order) situation. An
ideally suited agent would do three issues, retrieve the related troubleshooting information,
test whether or not the PO fee service is down proper now, and create a
assist desk ticket if wanted.

Conventional RAG, the sample most organizations have deployed, solely does step
one. It searches paperwork and retrieves content material. It might’t question a reside
monitoring system to test service standing, and it definitely cannot create a
ticket in ServiceNow or Jira. That hole between searchable and actionable is
the topic of this remaining subject, and we’ll use the PO situation to
elaborate.

The information entry spectrum

This framing comes from Microsoft’s Cloud
Adoption Framework for AI, which formalizes it as RAG + MCP-Learn +
MCP-Write.

1. Retrieval. RAG, vector search, doc lookup. The agent finds
   related content material. Most organizations reside right here right this moment.
2. Actual-Time Question. The agent queries reside techniques,
   checks service standing, reads from databases in actual time.
3. Write-Again. Essentially the most highly effective and most harmful tier. The agent
   creates tickets, updates information, triggers workflows.

Every step up the spectrum provides functionality, and threat. The PO situation maps
cleanly throughout all three.

• Retrieve the information (Retrieval)
• Test fee standing (Actual-Time Question)
• Create the ticket (Write-Again)

The shift to agentic AI requires all three, not simply the retrieval
most groups have constructed.

MCP has rapidly turn out to be the default technique to wire these tiers up, and its rise
has been remarkably quick. However the mechanism issues lower than the demarcation.
What counts is protecting retrieval, real-time reads, and write-back as separate,
intentionally ruled ranges of entry, whether or not you expose them by MCP or
your personal native APIs.

Three primitives, one protocol

Brokers attain all of this by MCP, the Mannequin Context Protocol. Its
primitives sit on a threat gradient, Sources (read-only) are protected, Prompts form
habits, and Instruments change state. That gradient maps straight onto the tiers,
Sources to retrieval and Instruments to write-back, which is why the protected path is to
expose Sources first and graduate to Instruments solely beneath governance. Within the PO
situation, Sources serve the troubleshooting docs, a Immediate guides triage, and
Instruments run check_service_status() and create_support_ticket().

Antipattern: naive API-to-MCP conversion

The way you design these Instruments issues as a lot as once you attain for them. The
frequent, pricey mistake is to take current REST APIs and wrap them one-to-one,
so each endpoint turns into a device. The result’s device sprawl, 50 instruments with
names like get_po_payment_status, create_ticket_po_payment,
create_ticket_po_payment_network. The agent then has to decide on amongst 50
barely-distinguished instruments with little context, and LLMs are dangerous at that;
accuracy drops sharply because the device depend climbs. The Thoughtworks Tech Radar put
“naive API-to-MCP
conversion”
on HOLD for precisely this purpose.

The higher method exposes the identical performance as a handful of
well-designed capabilities with wealthy descriptions and parameterized inputs.
check_service_status takes a service title and placement, one device for all
providers and all places. create_support_ticket is parameterized with
class, precedence, and outline. The descriptions are detailed sufficient for
the LLM to know when to succeed in for every one.

The precept is to design capabilities, not endpoints. 5 to 10 properly
described enterprise capabilities will outperform 50 skinny API wrappers nearly
each time. And this precept is protocol-agnostic, whether or not an agent reaches
your knowledge by MCP, by one other agent, or by no matter customary comes
subsequent, the properties that make it agent-ready are the identical, wealthy descriptions,
parameterized entry, clear schemas.

What a functionality declares

A wealthy description tells the agent when to succeed in for a functionality. It says
nothing about whether or not the agent is allowed to, or what occurs whether it is improper.
That’s the remainder of the declaration. Each functionality carries
permissions, who might invoke it and performing as whom, and an proprietor,
the particular person accountable when it misbehaves. Those that act carry two extra.

Preconditions are the situations that should maintain earlier than the motion might
proceed, checked towards reside state for the time being of performing slightly than towards
regardless of the agent learn earlier in its plan. A refund wants an authentic fee,
not but refunded, inside the quantity the invoking person might authorise.

Reversibility is the category of harm the motion can do: cleanly
reversible, reversible at a value by some compensating transaction, or
irreversible. That is the extra helpful predictor of protected autonomy than the cash
concerned. A $50,000 inside ledger correction you may again out is a safer factor
to automate than a $200 fee to an exterior account you can not claw again. The place
the staged autonomy ladder earlier keys its guardrails to transaction measurement, want
keying them to reversibility, and let irreversible actions require human approval
no matter stage the agent has reached.

Which raises the query of the place the foundations in these preconditions come from,
as a result of most of them are written down in prose someplace, in a refund coverage, a
contract, a compliance handbook.

Retrieved textual content informs, it by no means gates

Enterprise paperwork stay the place the enterprise writes its guidelines down. However a rule
that gates an motion should not be learn and interpreted for the time being of performing.
Guidelines are extracted from these paperwork forward of time, curated by a human, and
saved as declared preconditions within the functionality mannequin, every with a hyperlink again
to the passage it got here from.

At motion time the agent should learn unstructured content material, a grievance
ticket, a contract clause, to work out what to suggest. Solely the declared guidelines
resolve what’s permitted, and they’re checked deterministically towards reside
state. The boundary is between informing and gating. Retrieved textual content
can form what the agent suggests and function proof for a human approver, however
it by no means carries the authority to authorise the motion itself.

That boundary can be a safety property. Eradicating retrieved textual content from the
authorisation path means a poisoned doc can’t grant an agent a permission
it didn’t have already got, which is a stronger declare than merely shrinking what a
hijacked agent can attain. It isn’t a whole defence, as a result of injected textual content can
nonetheless affect what the agent proposes, and a human approver proven fabricated
proof might wave it by. What it removes is the trail the place the doc
authorises the motion immediately, with no one in between.

The provenance hyperlink is what retains the declarations sincere because the paperwork
transfer beneath them. Watch out what you promise right here. Detecting {that a} doc
modified is simple; understanding that the change invalidated a precondition derived from
it’s a judgement, not a diff. What the hyperlink buys you is a assessment queue, the
derived guidelines flagged for a human to re-check when their supply strikes, within the
identical spirit as keying a freshness SLA to when the index was final rebuilt slightly
than to when the content material final appeared to vary.

The place no declaration covers the scenario, the agent doesn’t improvise from
its personal studying of coverage. It escalates. That is the laborious gate from earlier in a
completely different setting, the identical intuition that claims any contract or SLA breach forces
a human slightly than a decrease rating. An undeclared case degrades the agent to
supervised, to not autonomous.

Extraction and curation is a pipeline like some other, and it wants an proprietor,
a cadence, and someone who clears the assessment queue. Which is the topic of a
later part, as a result of none of this maintains itself.

Finish to finish: the PO fee situation

With all three tiers in place, the PO situation we opened the part with runs
finish to finish, the agent retrieves the troubleshooting information (a read-only
Useful resource), checks the reside fee standing (a Instrument that reads), and recordsdata a
ticket (a Instrument that writes), all in a single workflow.

Determine 4:
One agent, three tiers: retrieval, real-time question, then write-back,
mixed right into a single response.

Performed manually, the worker would wait in a queue, clarify the difficulty, have a
help agent test the monitoring dashboard, and get a ticket created. The
agent is now in a position to do all this in a single cross.

The place to start out

The protected method in is to climb the tiers, not leap to write-back. Most groups
already reside in retrieval, the read-only tier the place threat is lowest. Write-back
is the place the true hazard sits. So earn your method up. Map what every use case
wants, expose read-only entry first, and add write-back final, solely
as soon as you may log each motion. Do not let the joys of an agent that may act
rush you previous the steps that make performing protected.

• 1. Map your knowledge entry tiers. Take your high three agent use instances and
  classify what every wants, retrieval, real-time question, or
  write-back. Most gaps reside in real-time question and write-back.
• 2. Design capabilities, not endpoints. Group current APIs into 5–10
  well-described enterprise capabilities. Wealthy descriptions matter, they’re what the
  LLM makes use of to resolve which device to name.
• 3. Begin with MCP Sources. Learn-only entry is the bottom threat entry
  level. Expose information bases, config knowledge, and documentation as Sources.
  Graduate to Instruments solely as soon as governance is in place.
• 4. Instrument from day one. Earlier than deploying any agent with write
  entry, log each device invocation, who triggered it, what was referred to as, when, and
  critically, on whose behalf. This feeds the audit path from the Traceability
  and Governance part.