# Let agents query the warehouse without draining it

Natural-language SQL is one tool call away from a full-table export. Constrain the statement, cap the pull, and mask what comes back.

For: Data platform owners exposing Snowflake, BigQuery, or Databricks to agents

A warehouse connector usually exposes one very powerful tool: run this SQL. That single tool is the entire attack surface. A misread instruction turns "summarize last quarter" into a `SELECT *` across a table of customer records, or an `EXPORT`/`COPY INTO` that ships the data straight out.

The policies inspect the SQL argument at ingress. `guard-warehouse-sql` denies DML, DDL, and grant statements and forces read-only queries; `guard-warehouse-export` blocks the export and stage-copy constructs that relocate data in bulk. `fence-sensitive-schemas` keeps the agent out of the schemas holding regulated data, and `redact-pii-egress` masks identifiers in the rows that do return. Because managed warehouse servers expose admin-named and dynamic tools, pair these with `default-deny-unknown-tools` so a tool nobody audited is denied until it's reviewed.

The same pattern ports across Snowflake, BigQuery, and Databricks — one warehouse posture, three engines.

## Policies in this guide

- [Block Destructive and Mutating Snowflake SQL](https://www.intentbasedpolicy.com/policies/snowflake/guard-warehouse-sql) — Inspects the SQL text that Snowflake MCP tools carry in their query argument and denies any statement in a mutating or destructive class — DROP, TRUNCATE,…
- [Block Bulk Export & External Staging (Snowflake)](https://www.intentbasedpolicy.com/policies/snowflake/guard-warehouse-export) — Blocks Snowflake SQL-execution tool calls whose query text moves whole tables off the Snowflake perimeter — bulk export to cloud storage or a stage, and…
- [Fence Snowflake Sensitive Schemas by Data Domain](https://www.intentbasedpolicy.com/policies/snowflake/fence-sensitive-schemas) — Fences customer-designated sensitive data domains inside a Snowflake warehouse by inspecting the SQL text the agent is about to run — not by tool name, which…
- [Block Destructive SQL in BigQuery Queries](https://www.intentbasedpolicy.com/policies/bigquery/guard-warehouse-sql) — Inspects the raw GoogleSQL string carried by BigQuery write-capable query tools and denies any statement in a state-changing class — DML…
- [Snowflake: Redact PII from Query Result Sets](https://www.intentbasedpolicy.com/policies/snowflake/redact-pii-egress) — Scans the row content returned by the result-returning Snowflake MCP tools and rewrites personally identifiable information to fixed redaction tokens before…