When you point an AI agent at a data warehouse, the agent becomes the thing standing between your users and every row they're not supposed to see. If that boundary lives only in the application, it fails the moment the application does. This release moves those boundaries down to where they hold the data source enforces access, raw SQL is something you can close off entirely, and protection is on by default instead of waiting for someone to switch it on.
Identity follows the user to the source
Ana used to reach data sources through a shared service account. Every user's query ran under the same identity, which meant the source system couldn't tell the CFO from an intern, and its logs recorded one account running everything. Access control and audit trails both broke at that boundary.
Per-member SSO for SAP HANA and per-member OAuth for BigQuery close it. Each member signs in under their own identity, so queries run with that person's real credentials and permissions. HANA and BigQuery enforce what each user is actually entitled to, and their logs show who ran which query.
Raw SQL is something you can govern, or turn off
Ad-hoc SQL is powerful and, against sensitive sources, sometimes more power than you want to hand out. Ana now controls it from two directions.
A connector can be restricted to Ontology TQL queries which blocks raw SQL against that source entirely. Anything outside the Ontology is refused and written to the audit log, so the source is reachable only through paths you've approved. Separately, administrators can turn raw SQL off across an entire organization and gate it behind a dedicated raw-SQL permission, revocable independently of read and write, with every run recorded.
Protection on by default
The most useful guardrails are often the ones nobody has to remember. Connector credentials are now always encrypted at rest with a key you control, and that key is required rather than optional. Plaintext storage is gone: existing plaintext credentials are encrypted on upgrade, and an install without a configured key is rejected outright.
Datasets created from a Tableau connector now enforce object-level access control from the moment they exist, with each grant recorded in the audit log — the same treatment every other dataset in Ana already gets.
Down to how tools sign in
The same principle reaches command-line access. CLI tools sign in through a browser-approved device flow: you run a login command, approve a short code in a browser session where you're already signed in, and the tool receives credentials. The tool gets a scoped identity of its own rather than inheriting your full account, a token can't approve another device and escalate itself, and every approval is individually revocable and written to the audit log.
Taken together, these changes move governance from something you configure to something Ana enforces.
