Ran as you

The default way to wire an agent to a warehouse is a service account. It is also the way to make every question your company asks look identical. When forty people work through agents that all authenticate as svc_analytics, the audit log records a machine having a very busy quarter. “Who saw this table?” (the first question any review asks) has no answer, and the warehouse's own access controls, built over decades around who is asking, have nothing to hold on to.

Per-user credentials, executed identity

We made the agent inherit the person. When a query arrives through an agent, the layer resolves the human principal behind it and executes with that person's credential, not a shared one. The run records its executed identity alongside the agent that carried it, and in strict mode the rule is absolute: no per-user credential, no agent query.

The immediate payoff is that the warehouse's existing access model starts working again, for free. Row policies, column masking, and grants apply to the agent's query exactly as they would in the console, because as far as the warehouse is concerned the person is asking. There is no second, parallel permission system to define and drift; the one your data team already maintains is the one agents obey.

Trust is a two-sided ledger

The subtler payoff is legibility in both directions. The person who asked sees a “Ran as you” badge on their result: this answer came from data you were allowed to see, under your own name. The data team sees the other side: a query ledger where every row names an agent, a person, and the objects touched, so attribution survives even when the asking is delegated to software.

The open end of this work is delegation. Passing a person's credential through is honest but blunt; what an agent should really carry is a narrower, expiring authority to act on someone's behalf: on-behalf-of tokens scoped to a task rather than a person's whole reach. That is the direction we are exploring; the invariant we won't give up is the one this note is named for: every query, a name.