What Does an Agent Need to Work Safely With Regulated Data?
Why connectivity, semantic context, access controls, and auditability matter for agentic analytics?
The Challenge
An AI agent can query enterprise data. The harder question is whether the result can be trusted when that data is regulated.
Consider a bank that wants an agent to answer questions about customer exposure. The agent can reach the database through the Model Context Protocol (MCP), but connectivity alone does not tell it which definition of exposure to use, which customers the requesting analyst is authorized to see, or what queries it issued along the way. Those are separate concerns, and MCP does not define all of the controls around them.
For regulated analytics, then, the question is not only whether an agent can reach the data. It is whether the surrounding data platform provides the context, controls, and evidence needed to use that access responsibly.
Where MCP fits
MCP addresses the connectivity layer. It standardizes a way for AI applications to discover and invoke tools and data sources, reducing the need for custom integrations. It does not, by itself, define the meaning, the permissions, or the audit model around that connection.
Gartner’s 2026 research on agentic analytics emphasizes trust, governance, and context as organizations move from experimentation toward deployment. Its research on semantic and structural data modeling also highlights the importance of grounding agents in business meaning and enterprise context.
An agent working from raw tables can produce technically valid SQL while still using the wrong business definition, accessing the wrong rows, or providing insufficient evidence for an audit. Those are three different failures, and they are resolved by three different controls.
Four requirements for governed agentic analytics
Governance covers several different controls. Keeping them separate makes it easier to see which failure each one addresses and where that control belongs. For regulated agentic analytics, four requirements matter: semantic context, governed access, controlled execution and data location, and auditability.
Semantic context → What does the data mean?
Governed access → What can the agent access and execute?
Controlled execution → Where does processing happen?
Auditability → What evidence remains afterward?
1. Semantic context
Agents need consistent definitions for metrics, entities, and relationships. A semantic layer can provide a shared source for those definitions, reducing the risk that different tools or different steps in the same agent run interpret the same business concept differently. Shared definitions also make the resulting numbers explainable after the fact.
This requirement is about correctness, not security. An agent can be perfectly authorized and still return a figure that does not match the one in the quarterly report.
2. Governed access
Authorization is a separate control. Two controls are especially relevant: limiting the operations an agent can perform and applying database access controls to the authenticated identity. A database user limited to read operations restricts what the agent can change and reduces the scope of actions that need to be governed. Where row-level access controls are applied to the authenticated database identity, the agent’s results can be constrained by that identity’s permitted rows.
Enforcing these controls in the data platform can provide a consistent control point across agents, notebooks, dashboards, and other database access paths, rather than reimplementing them in each orchestration layer.
3. Controlled execution and data location
Some analytical work involves unstructured text: classification, extraction, summarization. For some regulated workloads, the location of AI and text processing matters alongside the location of the underlying data. Exasol provides in-database text analysis through its Text AI capabilities, including entity recognition, summarization, keyword extraction, and information extraction. In deployments that keep the text-processing operation inside the controlled data environment, the source text does not need to be sent to an external inference endpoint.
These properties should be distinguished for each deployment. “No outbound network dependency,” “no data egress,” and “fully disconnected operation” are three different properties, and a workload may require one without requiring the others. They should be verified independently for each deployment.
4. Auditability
Regulated analytics also needs evidence that can be inspected after the event. That includes query history and related records stored and retained according to the organization’s database and infrastructure controls.
Query logging tells you which statements were executed. Reconstructing everything an agent did, including the reasoning steps and tool calls between queries, is a broader problem. The database can supply the query history. Full agent traceability also requires records from the agent framework.
Two architectural models
Two architectural patterns illustrate where these controls can live.
Where Exasol 2026.1 fits
Exasol 2026.1 includes capabilities relevant to several of these requirements. The mapping below is stated capability by capability rather than as a single bundled claim, and each entry links to the relevant Exasol documentation or product page.
| Requirement | What it addresses | Relevant Exasol capability / integration |
| Semantic context | Consistent business definitions | Exasol Semantic Layer, a partner product from eviit built on Exasol Virtual Schema technology |
| Governed operations | Limits what an AI assistant can execute | Exasol MCP server, configured with a least-privilege database user |
| Row-level access | Controls which rows a user or role can access | Exasol row-level security, applied per role or tenant |
| Controlled AI execution | Processing close to governed data | Exasol Text AI, run inside the database |
| Auditability | Evidence of executed SQL | Exasol auditing, recorded in the audit system tables |
| Deployment and data location | Infrastructure and data-residency requirements | Exasol deployment options, per the deployment documentation |
MCP access executes with the permissions of the configured database user. A dedicated least-privilege user therefore limits what the assistant can execute. How row-level controls apply when an agent acts on behalf of a person depends on authentication and identity propagation in the deployment.
MCP queries appear in Exasol’s standard audit tables, while the MCP server does not maintain a separate audit log. Reconstructing the agent’s full decision path therefore also requires records from the agent framework.
Conclusion
MCP gives an agent a standardized way to connect to enterprise tools and data. The surrounding data platform determines what that agent can understand, access, execute, and what evidence remains afterward.
MCP provides the connectivity. The data platform provides the context, controls, and evidence that make that connectivity governable. For regulated analytics, trust depends on the architecture around the agent, not the connection alone.
Sources / Further Reading
Analyst research and Exasol product documentation referenced in this article. The February 2026 edition of the Market Guide is available to Gartner clients; the reprint pages below are published with Gartner’s permission.
- Gartner, Market Guide for Agentic Analytics, Deepak Seth, Georgia O’Callaghan, Fay Fei and Jeroen Cornelissen, 9 February 2026. Available to Gartner clients; there is no public page for this edition, so the licensed reprints below are the publicly accessible references.
- Gartner newsroom, Gartner Announces Top Predictions for Data and Analytics in 2026, 11 March 2026.
- Licensed reprint, 2026 Gartner Market Guide for Agentic Analytics, via ThoughtSpot.
- Cube, Cube Recognized in the 2026 Gartner Market Guide for Agentic Analytics, February 2026.
- Unsupervised, 2026 Gartner Market Guide for Agentic Analytics summary, February 2026.
- Exasol, Exasol Semantic Layer by eviit, product page.
- Exasol, Virtual Schemas, database documentation.
- Exasol, MCP Server, GitHub repository.
- Exasol, Data Security, database documentation, including row-level protection by role or tenant.
- Exasol, Auditing, database documentation, including the audit system tables.
- Exasol, Text AI, product page.
GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved. Gartner does not endorse any vendor, product or service depicted in its research publications, and Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact.