Give the agent read access to published dashboards and their certified datasets, under the asking person's own data permissions, and require every answer to cite the tile, the metric definition and the last refresh time. It answers internal questions at depth 1. Answers bound for the board, lenders or anyone outside are held for a named person.
What does the agent touch, and who owns it?
A BI tool sits on top of the warehouse. It holds dashboards, the datasets behind them, metric definitions and access rules. Most finance teams already have a person who owns the semantic layer: the definitions of revenue, gross margin, headcount and days sales outstanding that every dashboard shares. That person, usually in FP&A or a data team, owns what the agent may say.
The agent does not own a number. It reads one, explains where it came from and says when it cannot answer. That is the whole job, and it is worth doing because most questions to finance are "what was X last month and why did it move", asked again and again by people who could not find the right tile.
The connection itself is covered in connecting an AI agent to your BI tool. This playbook covers what the agent may do once connected, within the general bounds for finance agents set out in AI agents for finance.
Which capabilities do you grant, and at what depth?
Grant per capability, not per tool. A BI service account that can read everything is the most common over-permission in finance.
- Agent, depth 1: reads certified dashboards. Only those marked as published and owned. Draft dashboards and personal workbooks are out of scope.
- Agent, depth 1: queries the dataset behind a tile. Only certified datasets, only aggregates, under the row-level rules of the person asking. If a sales manager cannot see another region, neither can the agent answering that sales manager.
- Agent, depth 2: drafts an answer for a pack or an email. A person sends it. This covers anything going to the board, a lender, an auditor or a customer.
- Agent, refused: edits a dashboard, a dataset or a metric definition. Changing what "revenue" means is a decision for the metric owner, through the BI tool's own change process.
- Agent, refused: exports row-level data. Questions that need individual transactions or people go to a person with the right access.
- Person, metric owner: approves the list of certified sources. Adds and removes datasets from the agent's scope. Evidence: a versioned source list.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Read dashboards | Reads published, owned tiles | 1 | Choosing which are published |
| Query datasets | Aggregates under the asker's access | 1 | Granting the asker's access |
| Answer internally | Replies with figure, definition, refresh time | 1 | Nothing for routine questions |
| Answer externally | Drafts the reply | 2 | Sending it |
| Change definitions | Nothing | refused | Metric owner |
| Row-level export | Nothing | refused | Person with access |
How do held answers and revocation work?
An answer is held when it leaves the building or when the data underneath is not final. The agent knows the close calendar: a question about last month, asked before the controller has signed the close, gets an answer marked provisional and, if it is for an outside reader, held until the close is signed. The person who approves it sees the draft, the figures cited and the refresh time.
Revocation must be per capability and immediate. If a dataset is found to be wrong, the metric owner removes it from scope and the agent stops citing it on the next question, without anyone touching the service account. If the agent's certificate lapses or a run clears no depth, it drops to depth 1 the same day; for this agent that is already its ceiling for most work, so the practical effect is that drafted external answers stop. Revoking the whole connection is the BI administrator's action and should be tested once before go-live.
Which controls matter, and what evidence does each leave?
Answer with a citation or not at all. Each answer names the dashboard, tile, metric definition and refresh timestamp. Evidence: the citation stored with the answer.
Asker's permissions, not the agent's. The agent queries with the access rights of the person asking. Evidence: the identity used on each query.
Definition drift check. If two certified dashboards compute the same metric differently, the agent says so rather than picking one. Evidence: a flagged conflict sent to the metric owner.
Staleness rule. Data older than the dataset's expected refresh is reported as stale. Evidence: refresh age on each answer.
Append-only log. Question, asker, queries run, answer and verdict. Evidence: the filed record.
What should you measure?
- Answers without a citation. Must be zero.
- Questions declined as out of scope, by reason. Repeated reasons tell you which dataset to certify next.
- Definition conflicts found. Each is a finding for the metric owner, not for the agent.
- Answers corrected after the fact. Every one is reviewed against its citation.
- Time from question to answer, compared with the queue to the finance team before.
Where does it usually go wrong?
The service account sees too much. The agent was connected with an administrator role "to make it work", and it answers a junior analyst with salary data by cost centre. Fix the access model before go-live, not after the first complaint.
Two revenues. The sales dashboard shows bookings, the finance dashboard shows recognised revenue, and both are labelled "revenue". The agent must quote the definition, and the metric owner should rename one.
Numbers before close. The agent answers a question about the month on day two and the figure moves on day four. Mark provisional data as provisional, every time.
Explaining causes it cannot see. "Margin fell because of freight costs" is a claim. The agent may say which lines moved; the reason needs a person or a cited note. For questions that go to the top, see whether an agent can answer a CFO's questions about the numbers.
Policy questions arrive in the same chat. People ask the BI agent about expense rules. Route them to a separate agent built for that; answering staff policy questions is a different source and a different certificate.
Questions people ask
Can the agent build a new dashboard when nothing fits?
Not in this design. It can describe the query it would need and send that to the data team, which keeps the certified layer under one owner.
What if the asker has no access to the data behind the answer?
The agent says it cannot answer and names who can. It never answers from its own wider access.
Should the agent answer forecast questions as well as actuals?
Only from a published forecast version, cited by name and date of approval. It should never extrapolate a forecast of its own in reply to a question.