AI agents need a semantic layer before they can query data reliably

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Island's blog post: AI agents can write correct SQL and still produce wrong analytics when they query raw data without a semantic layer.

Why it matters: For IAM and broader governance teams, the lesson is that AI reliability depends on controlled, validated business meaning, not just access to data sources.

Context

A semantic layer is a governed translation layer between raw data structures and the business questions people or agents ask. Without it, the same metric can be defined three different ways, and an AI agent will often choose one by guesswork rather than policy.

This matters for AI governance because the failure is silent: the query succeeds, the output looks credible, and the mistake only appears when decisions diverge. The same governance pattern that matters for NHI and agentic AI applies here too, because the consumer is autonomous enough to amplify bad definitions at scale.

Key questions

Q: How should teams prevent AI agents from returning wrong metrics from warehouse data?

A: Require agents to query through a semantic layer that encodes approved metric definitions, source tables, filters, and calendar logic. Raw schema access is not enough because it lets the model guess at business meaning. The control is to make meaning versioned, testable, and owned before the agent can use it.

Q: Why do AI agents produce plausible but incorrect answers from raw data?

A: Because syntax and meaning are different problems. An LLM can write valid SQL, but it cannot infer which tables are current, which accounts are synthetic, or how the organisation defines time periods unless those rules are formalised elsewhere. Without that business context, the agent can be confidently wrong.

Q: What are the signs that semantic governance is failing?

A: Common signals include the same metric being reported differently in separate dashboards, repeated disputes over field definitions, and manual reconciliation before analysis can begin. When teams keep rebuilding the meaning of data in each workflow, the governance model is too fragmented to support reliable reuse.

Q: How should teams decide whether to build a semantic layer before scaling AI?

A: Teams should build it first when multiple groups depend on the same metrics, when definitions already differ across tools, or when AI will consume the data directly. If the business cannot agree on authoritative meaning, scaling AI only multiplies the inconsistency. Governance must precede automation.

Technical breakdown

Why raw schemas do not give agents business meaning

A database schema describes structure, not intent. An LLM can usually turn a question into valid SQL because syntax is easy to infer from table and column names, but it cannot know which table is current, which records are synthetic, or how the organisation defines periods such as fiscal months. Those missing rules are usually stored in human memory, spreadsheets, or scattered SQL files. When an agent queries raw tables directly, it is forced to guess at those business rules, which creates silent analytical failure rather than an obvious technical error.

Practical implication: Treat schema access as insufficient for agentic analytics unless the meaning layer is explicit and machine-readable.

Metrics as code turns business definitions into governance artifacts

A semantic layer converts metrics from tribal knowledge into versioned definitions that can be reviewed, tested, and reused. In practice, that means the organisation can encode filters, source-of-truth tables, ownership, and reconciliation checks once, then compile every downstream query against the same logic. This is the governance shift that matters: the agent no longer invents its own interpretation of active users, revenue, or engagement. It inherits the approved definition. That reduces metric drift and makes inconsistencies visible before they reach decisions.

Practical implication: Model high-value metrics as governed code, not as dashboard-specific logic or ad hoc SQL.

Why autonomous querying changes the risk profile for analytics

Traditional BI users can often spot a suspicious number and ask for a rerun, but agents operate at machine speed and can propagate a wrong definition into many follow-on questions. That creates a compounding problem. If the agent starts with stale data, misread time boundaries, or hidden test records, every downstream slice and drill-down inherits the same error. The risk is therefore not just inaccurate reporting, but automated confidence in bad analysis. For organisations using agents as the front end to their warehouse, the semantic layer becomes the control point where trust is established before query execution.

Practical implication: Move trust decisions to definition time, before the agent reaches raw tables and multiplies the error.

Threat narrative

Attacker objective: The objective is not theft but decision corruption through credible-looking analytics that bypass business controls.

1. Entry occurs when an AI agent is given direct access to warehouse tables and asked to answer business questions without a semantic layer.
2. Credential or access abuse is not the main issue here; the failure is logical access to raw data without governed business definitions, so the agent guesses at meaning.
3. Impact appears when the agent returns plausible but wrong metrics that can drive false confidence, misaligned decisions, and repeated downstream errors.

Breaches seen in the wild

• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Semantic governance debt is now an AI risk, not just a data-team inconvenience: when metric definitions live in heads and scattered SQL files, agents inherit ambiguity at machine speed. The governance failure is not the warehouse itself but the absence of an enforceable contract around meaning. Practitioners should treat definition drift as a control problem, not a reporting annoyance.

The semantic layer becomes the policy boundary for agentic analytics: once an AI agent can query data on behalf of a business user, the key question is no longer whether the model can write SQL. It is whether the organisation has encoded the approved interpretation of each metric, filter, and calendar rule. That is a governance boundary that identity and AI teams both need to recognise.

Meaning, not syntax, is the new trust surface: the article shows that high-confidence output can still be materially wrong when business context is missing. That shifts assurance work toward version control, review, test coverage, and ownership for definitions. Practitioners should view semantic layers as part of the control plane for AI consumption of enterprise data.

Agentic data access creates a hidden equivalent of overprivileged interpretation: the agent may have permission to read the data, but not the right to invent its own business logic. That distinction matters because access control alone cannot prevent analytical misuse when the interpretation layer is absent. Teams should govern both access and semantics together.

Semantic layers are becoming foundational infrastructure for AI-ready analytics: the organisations that encode business logic now will absorb agentic use cases more safely later. The practical conclusion is straightforward: if the organisation cannot explain a metric consistently today, it should not let an agent operationalise that metric tomorrow.

What this signals

Semantic layers should be treated as control infrastructure for agentic analytics: once AI systems become primary consumers of warehouse data, the organisation needs a governed interpretation layer ahead of access, not after the first wrong answer. The practical change for teams is that semantic review, ownership, and test coverage become part of data governance, not optional polish.

The strongest indicator of readiness is whether the business can explain a metric consistently across Product, Finance, and Growth before the agent is allowed to use it. If those teams still disagree on the meaning of a core measure, an AI agent will not resolve the dispute, it will automate it.

For practitioners

• Define critical metrics as versioned code Move high-value business metrics into a shared semantic layer with ownership, review, and test coverage so every consumer resolves the same definition.
• Block direct agent queries to raw tables Force AI agents to query through governed definitions rather than ad hoc schema access, especially for finance, product, and growth reporting.
• Test semantic rules against edge cases Include deprecated tables, synthetic accounts, duplicate events, and fiscal calendar boundaries in validation so the agent cannot inherit hidden ambiguity.
• Assign business owners to metric validation Require business stakeholders to sign off that each definition matches the decision the organisation thinks it is measuring, not just the SQL that computes it.
• Treat semantic drift as a governance signal Track when analysts or agents are bypassing the layer, creating parallel definitions, or disputing the same metric across teams.

Key takeaways

• AI agents can write valid SQL and still produce wrong analytics when business meaning is not governed outside the raw schema.
• The semantic layer turns metric definitions into versioned, testable code that every downstream consumer must resolve the same way.
• For practitioners, the main control point is not query generation but the approved meaning that sits in front of it.

Key terms

• Action Layer: The action layer is the point where an identity moves from asking for access to doing something with that access. For AI agents, this layer matters because tool use can happen faster than human review, and the meaningful risk appears when actions are chained across systems.
• Runtime Drift: Runtime drift is the gap between an AI agent’s approved authority and its actual behaviour as conditions change. It appears when the agent adapts to new context, new integrations, or new instructions and begins acting outside the scope that governance originally defined.
• Versioned Definition: A versioned definition is a metric or rule stored as code with review history, tests, and change control. It lets teams track how a business concept changed over time and ensures AI consumers use the current approved interpretation.
• Business Context: Business context is the interpretive layer that explains what a dataset means, who owns it, how trustworthy it is and where it came from. In governance programmes, it turns raw metadata into something practitioners can use for accountability, access decisions and audit evidence.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader security decisions their programmes depend on.