The agent should read with the permissions of the person asking, never as a super-user. Reading dashboards and querying the governed data model are depth 1. Building draft dashboards in a sandbox is depth 2. Publishing, sharing, scheduled distribution and changes to certified metrics stay with the BI owner. Every query is recorded with whose behalf it ran on.
What does the connection involve, and who owns it?
A BI tool turns data from the ledger, the warehouse and operational systems into dashboards, metrics and reports. Finance teams use it to answer questions like "what did we spend on contractors by region last quarter?". An agent connected to it can answer those questions in conversation and build first drafts of new reports. The integration pattern, an agent calling a system's functions, is explained in what is tool use.
The BI or data lead owns the tool, the data models and the certified metrics. FP&A typically owns finance dashboards. The data protection owner cares about who can see what. Submit the connection through your normal process; a tool connection request template helps. The wider finance position is in AI agents for finance: books you can audit.
Which permissions should you grant, and at what depth?
| Action in the BI tool | Depth | Condition | Stays with a person |
|---|---|---|---|
| Read dashboards and reports | 1 | As the asking user | Nothing |
| Query the governed data model | 1 | As the asking user; row limit | Nothing |
| Export data | 1 | Row limit; asking user's rights | Large or sensitive exports |
| Create draft dashboards in a sandbox | 2 | Sandbox only | Publishing |
| Publish or share a dashboard | 2, held | Always held | BI owner |
| Schedule a report to a distribution list | 2, held | Always held | Report owner |
| Create or edit certified metrics | None | Refused by your limits | BI lead |
| Refresh datasets on demand | 3 | Within refresh quota | Nothing |
| Change data source connections | None | Refused by your limits | BI administrator |
Running as the asking user is the most important line. BI tools enforce row-level security: a regional manager sees their region, payroll analysts see salaries, others do not. If the agent connects with a broad service account and answers anyone's question, it becomes a way around those controls. Use delegated access so every query carries the asker's identity.
Scheduled distribution is held because it sends data to people automatically and indefinitely. A report sent to the wrong list keeps going until someone notices.
How do you set it up, step by step?
- Person, BI lead: decides which models the agent may query. Start with governed, documented models, not raw tables.
- Person, BI administrator: configures delegated access so the agent queries as the person asking.
- Person: creates a sandbox workspace where the agent's drafts live, invisible to others until published.
- Agent, depth 1: answers questions, citing the dashboard or model, the filters applied and the data's last refresh time.
- Agent, depth 2: builds drafts on request in the sandbox.
- Person, BI owner: reviews and publishes drafts that should be shared.
- Person: tests revocation for each level before go-live.
What stays with a person?
The definitions. A certified metric, such as "gross margin" or "headcount", is a decision about how the business measures itself. If the agent could edit one, every dashboard built on it would change without anyone choosing that. It can propose a new metric in a draft; the BI lead decides.
Interpretation of anything going to leadership also stays with people. The agent can say what the numbers show. Whether a variance is a problem is a judgement for FP&A.
How does BI data differ from ledger data?
BI figures are derived. They depend on models, filters, refresh times and joins someone built. That makes them useful for analysis and weak as evidence. When the agent answers from a dashboard, it says so, with the refresh time. When a question needs the authoritative figure, such as a balance an auditor will rely on, it should come from the ledger, which carries sealed provenance. How the agent reaches different finance systems is covered in which accounting systems an AI agent can connect to.
How do you revoke access?
Remove a model from the agent's allowed list and questions on it are refused. Withdraw the sandbox and drafting stops. Revoke the delegated access configuration to stop all BI work at once. A certification run that clears no depth drops the agent to depth 1 the same day; for BI, where most work is already depth 1, that mainly stops drafting and refreshes.
What is recorded for each action?
Every query and action is filed as a verdict: who asked, which model or dashboard, the filters, the rows returned, the refresh time of the data, and the bound that decided. Exports also record the row count and destination. The BI tool's own audit log should show the same queries under the asker's identity with an agent marker. If it shows them under a service account instead, delegated access is not working.
Where does it usually go wrong?
The agent runs as an administrator. It was easier to set up. Now any staff member can ask it for any data. Fix this before go-live, not after.
Stale data is answered as current. A dataset failed to refresh overnight and the agent answers from yesterday. Always state the refresh time.
Drafts multiply. The sandbox fills with hundreds of near-identical dashboards. Expire drafts after a set period unless published.
Connections overlap. The same agent may read invoices through the AP tool and spend through the expense tool. Keep the rules consistent; compare connecting an AI agent to your accounts payable automation tool and connecting it to your expense management tool.
Where Pryme fits
In Pryme, each BI capability, such as querying a model, drafting in the sandbox or publishing, has its own depth and certificate. Answers from dashboards carry their source and refresh time, so a reader can tell a derived BI figure from a sealed ledger balance.
Questions people ask
Can the agent write queries directly against the warehouse?
That is a separate connection with its own grants. Through the BI tool, keep it to the governed models, where definitions are already agreed.
Should answers include charts?
They can, built from the same query. Label the chart with its source and refresh time, as you would the numbers.
What if two people ask the same question and get different answers?
That is usually row-level security working as intended. The record shows each query ran under a different user.