The first question every security team asks us is the same: what data do you copy? The answer is none. Not because we are being cautious for its own sake, but because the interesting signal was never in the rows.
The rows are not where the meaning lives
A table of 40 million transactions tells you very little about how a business works. The meaning sits one layer above: in which columns get joined, which filters appear in every trusted query, which dashboard the CFO actually opens on Monday morning.
That layer is metadata, and it is far smaller, far less sensitive, and far more informative than the underlying data.
Four signals we read
1. Schema and lineage
Table names, column types, foreign key relationships, and dbt model dependencies. This gives us the shape of the business — what entities exist and how they relate.
2. Query patterns
Warehouse query history, stripped of result sets. A filter clause that appears in ninety percent of revenue queries is a business rule, whether or not anyone documented it as one.
Nobody wrote that down. Everybody uses it. It belongs in the knowledge layer.
3. Usage weight
A dashboard that three people open daily carries more authority than one built eighteen months ago and never revisited. We use access frequency and recency as a trust signal, not a popularity contest.
4. Human resolution moments
Slack threads where a debate ended with a decision. Pull request reviews where a metric was renamed and approved. These are the moments where tribal knowledge became consensus — and they are almost never captured anywhere durable.
What we store from a thread: the extracted definition and a link back to the source. Not the message bodies, not the participants, not anything adjacent to the conversation.
The permission model this enables
Because we operate on metadata, the access we request is narrow by construction:
| Source | Scope requested | What we never touch |
|---|---|---|
| Snowflake | INFORMATION_SCHEMA, QUERY_HISTORY | Table contents |
| dbt Cloud | Manifest, catalog | Materialised results |
| Slack | Channel list, pinned items | DMs, private channels |
| Tableau | Workbook metadata, view stats | Extracts |
Read-only, scoped, revocable. A security review that would take weeks for a data-ingesting tool typically takes a single call.
What we give up
Honesty demands the trade-off. Metadata-first means we cannot answer questions that require the data itself — "what was the largest transaction last quarter" is not something we can compute. We tell you the definition of "transaction" your company uses, and your agent queries your warehouse for the number.
In practice this division holds up well. The questions that break enterprise AI are almost never arithmetic. They are questions of meaning, and meaning lives in metadata.
Mahari Kalau
Writes about context engineering, agent architecture, and the unglamorous parts of enterprise AI.