AI Agent Solutions for Data Warehouse Access and Security

meta · Tech · 2025 · source Agentic: yes · promotional bias: low · source-backed · extracted with prompt 0.5.2 (schema v2)

Generated from extraction.json — do not edit by hand. Every claim cites verbatim source evidence; stated means the quote directly asserts the claim, implied means it supports it indirectly.

Problem

Domain: Enterprise data warehouse access

Meta needed to keep warehouse access secure while AI-driven and cross-domain data use made human/local approval processes harder to scale.

Constraints:

• massive warehouse scale
• security boundaries
• human and agent users
• risk management

Architecture

Meta models warehouse access as a multi-agent collaboration between data-user agents and data-owner agents. The data-user agent is coordinated by a triage agent and includes sub-agents for suggesting alternatives, enabling low-risk exploration, and crafting/negotiating permission requests. The owner side includes security-operations and access-management sub-agents. For partial data preview, user activity/profile/query shape informs intention, the owner agent fetches metadata and SOPs, an LLM proposes a decision/reasoning, and output guardrails enforce rule-based risk calculations with logs, traces, evaluation datasets, and feedback/audit flywheels.

Diagram confidence: explicit (topology described by the source).

flowchart LR
  data-user-agent[Data-user agent] --> triage-agent[Triage agent]
  triage-agent --> alternative-suggestion-sub-agent[Alternative suggestion sub-agent]
  triage-agent --> low-risk-exploration-sub-agent[Low-risk exploration sub-agent]
  triage-agent --> permission-request-sub-agent[Permission request sub-agent]
  data-user-agent --> user-activity-tool[User activity tool]
  data-user-agent --> user-profile-tool[User profile tool]
  data-user-agent --> data-owner-agent[Data-owner agent]
  low-risk-exploration-sub-agent --> data-owner-agent
  permission-request-sub-agent --> data-owner-agent
  data-owner-agent --> metadata-and-sop-resources[Metadata and SOP resources]
  data-owner-agent --> output-guardrail[Output guardrail]
  data-owner-agent --> audit-feedback-flywheel[Audit feedback flywheel]

Components

Data flow

A data user begins discovery or hits an access control. The data-user agent gathers context from activity and profile tools, formulates explicit or implicit business intention, and invokes a data-owner agent. The owner agent analyzes the query and resources, fetches table summaries, column descriptions, semantics, and SOPs, generates a decision and rationale, then sends it through an output guardrail aligned with rule-based risk calculations. Decisions, traces, context, and outputs are stored for evaluation, feedback, and auditing.

Why this architecture

Meta moved from local role-based decisions to multi-agent workflows because AI and humans increasingly work across warehouse domains, making access context dynamic and hard to model analytically. Splitting user and owner agents decomposes security/productivity goals, while guardrails, risk budgets, and feedback/audit traces keep language-model reasoning bounded.

Models used: LLM agents

Scale

• Meta’s data warehouse supports analytics, ML, and AI use cases at large scale.
  “As part of its offline data systems, Meta operates a data warehouse that supports use cases across analytics, ML, and AI.”article, stated
• Partial preview is controlled by four orchestrated capabilities: context, query-level access control, budget, and rule-based risk management.
  “To make the system work seamlessly end to end, four key capabilities (illustrated below in Figure 10) are orchestrated by an agentic workflow:”article, stated
• Data-access budgets refresh daily as a first line of defense.
  “Employees are given a data-access budget based on the amount of data they typically access, and this budget, which refreshes daily, is our first line of defense.”article, stated
• Evaluation runs daily over datasets curated from real historical requests and associated user context/query runs.
  “This involved compiling historical requests, collecting user activities and profile information, associating them with query runs, and then using this data for evaluation. We run the evaluation process daily to catch any potential regressions.”article, stated

Alternatives considered (roads not taken)

Traditional local role-based access decisions

Rejected because: Cross-domain AI data use makes local, team-based approvals insufficient.

One monolithic access agent

Rejected because: Meta explicitly decomposes the problem into user and owner agents, then user-side specialized sub-agents.

Unbounded data preview for exploration

Rejected because: Partial preview combines task context, query shape, access budgets, and rule-based risk management.

Patterns

multi-agent-orchestration (access-control)

Separate user and owner agents collaborate while keeping distinct responsibilities.

safety-policy-enforcement (security)

Meta uses guardrails, auditing, feedback, risk management, and context-aware controls to bound agent behavior.

Tradeoffs

How to decompose access assistance.

Chose separate user and owner agents over one monolithic access agent.

Rationale: The split lets each side focus on different security and productivity objectives.

Access-agent decomposition.

Chose separate data-user and data-owner agents with specialized sub-agents over one generalized warehouse access agent.

Rationale: Different security/productivity goals need separate focus and coordination rather than a single blended role.

Preview safety model.

Chose context-aware partial data preview with query controls, budgets, and risk rules over granting full access for exploration.

Rationale: The preview path supports exploration while bounding exposure and defending against agent malfunction or attack.

Gotchas (what bit them)

Role-based local access decisions struggled with cross-domain AI data use.

Root cause: AI systems process across portions of the data graph where prior human-driven access decisions were partitioned.

Resolution: Adapt the warehouse access workflow for agents and humans working together with explicit risk controls.

Evaluation

Meta describes auditing and feedback systems rather than public quantitative results.

Metrics: auditing · feedback · risk management

Outcomes

• The proposed agentic workflow integrates into data products for safer, more streamlined access.

Engineering design case, no deployment metrics in extracted source.