{
  "schema": "hangingcontext.desk/1",
  "type": "story",
  "id": "711",
  "slug": "governed-agent-data-layer",
  "edition": "2026-10-28T00",
  "url": "https://hangingcontext.com/stories/2026-10-28/governed-agent-data-layer/",
  "newsroom": "artificial-intelligence",
  "beat": "infrastructure",
  "newsroom_title": "Artificial Intelligence",
  "angle": "Agent failures are now a context and governance problem, and data platforms are answering with governed access instead of raw access",
  "headline": "Agents stopped failing on SQL. Now they fail on context, and platforms are adding the guardrails",
  "dek": "Snowflake governed MCP access, Databricks federation, Zep temporal context and Writer controls all point the same way: agents need rules about data, not just a connection to it.",
  "published_at": "2026-10-28T00:51:44Z",
  "labels": {
    "trust": "confirmed",
    "trust_text": "Confirmed · 5 sources",
    "newsroom": "Artificial Intelligence"
  },
  "source_count": 5,
  "publishers": [
    "databricks-blog",
    "snowflake-medium-rss",
    "writer-blog",
    "zep-blog"
  ],
  "key_facts": [
    {
      "text": "Snowflake says its managed MCP server is a schema-level object that allows AI assistants to access warehouse tools without running external containers, all MCP tool calls are audited in Snowflake query history under the real user and role, and it supports five types of tools.",
      "cites": [
        {
          "claim_ids": [
            "1793139532907497694",
            "1793139532927473437",
            "1793139532915385706"
          ],
          "manifest_id": "1793139253795303754"
        }
      ],
      "self_reported": true
    },
    {
      "text": "Zep says data agents now fail on context more than on SQL, more than 60% of remaining failures with the strongest model came from a wrong reading of the data environment, and a temporal context graph stores business facts as records with dates and sources.",
      "cites": [
        {
          "claim_ids": [
            "1793135029713032419",
            "1793135029723447049",
            "1793135029725780793"
          ],
          "manifest_id": "1793134675156549411"
        }
      ],
      "self_reported": true
    },
    {
      "text": "Databricks says Lakehouse Federation allows users to query external databases without moving or migrating data, supported external databases include SQL Server, PostgreSQL, MySQL and Snowflake, and Unity Catalog allows joining federated on-premises data with shared marketplace data in a single SQL query.",
      "cites": [
        {
          "claim_ids": [
            "1793135237341537169",
            "1793135237344870851",
            "1793135237364896872"
          ],
          "manifest_id": "1793134867504579572"
        }
      ],
      "self_reported": true
    },
    {
      "text": "Writer says Playbook approvals create structured checkpoints for human review in agentic workflows, it shipped a skill security scanner to detect malicious instructions in skill files, and a new data loss prevention guardrail blocks PII, financial data and credentials from reaching models.",
      "cites": [
        {
          "claim_ids": [
            "1793124525606410716",
            "1793124525608309030",
            "1793124525611648800"
          ],
          "manifest_id": "1793124157089965924"
        }
      ],
      "self_reported": true
    }
  ],
  "images": [],
  "sections": [
    {
      "heading": "The governed door",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1793139532907497694",
                "1793139532915385706",
                "1793139532927473437",
                "1793139532967306535",
                "1793139532975035386",
                "1793139532979462334"
              ],
              "manifest_id": "1793139253795303754"
            }
          ],
          "markdown": "The Snowflake managed MCP server is the clearest version of the new pattern. The company says it is a schema-level object that allows AI assistants to access warehouse tools without running external containers, and it supports five types of tools: Cortex Agent, Cortex Analyst, Cortex Search, read-only SQL, and custom UDFs or procedures. All MCP tool calls are audited in Snowflake query history under the real user and role, tagged with the MCP request ID. The limits are stated openly too: the server currently supports a maximum of 50 tools per server, responses from GENERIC and SQL tools are truncated at 250 KB, and it does not currently support MCP resources, prompts, sampling or notifications."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1793139532935110454",
                "1793139532943353235",
                "1793139532959499646",
                "1793139532951173622"
              ],
              "manifest_id": "1793139253795303754"
            }
          ],
          "markdown": "The design details show how easily governance fails when it is left to defaults. Eylon Steiner recommends separating Cortex Agent tools for business users from read-only SQL tools for engineers to prevent models from bypassing semantic layers, and semantic views are required for Cortex Analyst tools to provide accurate, governed answers. Programmatic Tokens without role restrictions can allow users to list tools even if they lack specific grants, if DEFAULT_SECONDARY_ROLES is set to ALL. Custom procedure tools used in MCP must return a VARIANT type rather than a table to function correctly. None of that is glamorous, and all of it is the work that decides whether an agent answer is trustworthy or merely fluent."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1793139532200022665",
                "1793139532204308441",
                "1793139532211990010",
                "1793139532239861533",
                "1793139532243760917",
                "1793139532251478979"
              ],
              "manifest_id": "1793139253795612681"
            }
          ],
          "markdown": "A companion Snowflake write-up shows what happens when a team builds on top of that server. The author built a local web UI to interact with Snowflake managed MCP servers, using a proxy that prevents programmatic access tokens from appearing in browser history or devtools, and the console proxy binds to 127.0.0.1 and rejects requests with non-matching Origin headers. The UI dynamically generates forms based on the inputSchema of MCP tools, agent responses include Vega-Lite specifications for chart rendering, and the author observed that agent responses include token usage and timing metadata. The author also warns that agents may interpret user intent incorrectly despite generating valid SQL. That warning is the whole story in one line: a correct query is not the same as a correct answer."
        }
      ]
    },
    {
      "heading": "Context, not just connection",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1793135029713032419",
                "1793135029717545749",
                "1793135029716306464",
                "1793135029723447049"
              ],
              "manifest_id": "1793134675156549411"
            }
          ],
          "markdown": "Zep makes the case that the missing piece is usually context, not query skill. The company says data agents now fail on context more than on SQL, and most business context lives outside table metadata. In a 2026 benchmark study cited by Zep, agents on the strongest model failed more often at finding the right data than at writing the query, and with the strongest model, more than 60% of the remaining failures came from a wrong reading of the data environment. That finding reframes a lot of agent work: improving the model or the SQL generator will not fix a failure that comes from not knowing what a field meant last quarter, or which source is authoritative this quarter."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1793135029721452538",
                "1793135029720756255",
                "1793135029726419119",
                "1793135029725780793",
                "1793135029727616576"
              ],
              "manifest_id": "1793134675156549411"
            }
          ],
          "markdown": "The evidence Zep reports is sobering for teams that treat context as documentation. None of the write-ups in its study describes a record of when a business fact applied, 13 of the 15 teams depend on people to write or approve this context manually, and 10 of the 15 teams check for stale data or context. One team saw its agent accuracy on its evaluation set fall from about 95% to about 65% in the month after launch due to stale context. The answer proposed by Zep is a temporal context graph that stores business facts as records with dates and sources. Anthropic, cited in the same write-up, keeps documents in the same repository as the model it describes to ensure updates occur in the same pull request. The common thread is versioning: business facts need a history, not just a description."
        }
      ]
    },
    {
      "heading": "Federation and extraction, governed",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1793135237341537169",
                "1793135237344870851",
                "1793135237346224957",
                "1793135237348764498",
                "1793135237350642714",
                "1793135237376875274",
                "1793135237364896872"
              ],
              "manifest_id": "1793134867504579572"
            }
          ],
          "markdown": "Databricks Lakehouse Federation attacks a different part of the same problem: where the data lives. The company says Lakehouse Federation allows users to query external databases without moving or migrating data, and supported external databases include SQL Server, PostgreSQL, MySQL and Snowflake. Federated connections are configured through the Databricks UI, foreign catalogs map external databases to native Unity Catalog objects, and queries against federated sources execute in real time against the source database, with no materialized views or persisted objects required. Unity Catalog allows joining federated on-premises data with shared marketplace data in a single SQL query, and Databricks Genie can translate natural language into queries for federated data. The governance benefit is that the data stays under its original controls while the agent still gets a single query surface."
        }
      ]
    },
    {
      "heading": "Controls around the agent itself",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1793124525592853135",
                "1793124525606410716",
                "1793124525608309030",
                "1793124525612596134",
                "1793124525611648800",
                "1793124525607615297"
              ],
              "manifest_id": "1793124157089965924"
            }
          ],
          "markdown": "The new enterprise features from Writer close the loop around the agent rather than around the data. The company is releasing features for enterprise control over AI content and workflows, including Playbook approvals that create structured checkpoints for human review in agentic workflows, and new Playbook admin controls that restrict who can create and publish workflows. It shipped a skill security scanner to detect malicious instructions in skill files, customers can choose whether to automatically disable flagged skills, and a new data loss prevention guardrail blocks PII, financial data and credentials from reaching models. Writer Model Context Protocol allows running Playbooks and fetching work from MCP-compatible clients, and Enterprise Brain context will be available via Writer MCP next month."
        }
      ]
    }
  ],
  "unresolved": [
    "Whether the 95% to 65% accuracy fall reported by one team in Zep study generalises to other agent deployments",
    "How Snowflake managed MCP server limits, including 50 tools and 250 KB truncation, affect large enterprise agent workloads",
    "Whether temporal context graphs will be adopted as a standard layer or remain a vendor-specific feature"
  ],
  "decision_card": {
    "not_for": [
      "Teams that need MCP resources, prompts, sampling or notifications, which Snowflake managed MCP does not currently support",
      "Buyers who want a single vendor for the whole data context layer"
    ],
    "useful_for": [
      "AI developers building agents on enterprise data",
      "Platform teams deciding how agents reach warehouses, documents and business context"
    ],
    "compare_against": [
      "Direct database access with hand-written prompts",
      "Untracked agent tool access to production data"
    ]
  },
  "writer": {
    "agent": "muse",
    "run_id": "2026-10-28T00"
  },
  "corrections": [],
  "cited_manifest_ids": [
    "1793139253795303754",
    "1793134675156549411",
    "1793134867504579572",
    "1793124157089965924",
    "1793139253795612681"
  ],
  "manifests": [
    {
      "title": "Snowflake's Managed MCP Server: Giving AI Assistants a Governed Door Into Your Warehouse (Part 1)",
      "source_url": "https://medium.com/snowflake/snowflakes-managed-mcp-server-giving-ai-assistants-a-governed-door-into-your-warehouse-part-1-09077cd30c61",
      "manifest_id": "1793139253795303754",
      "source_name": "snowflake-medium-rss",
      "published_date": "2026-10-27"
    },
    {
      "title": "Metadata is the easy part of a data context layer",
      "source_url": "https://getzep.com/blog/metadata-easy-part-data-context-layer",
      "manifest_id": "1793134675156549411",
      "source_name": "zep-blog",
      "published_date": "2026-10-27"
    },
    {
      "title": "Unlocking Investment Insights Without Migrating Your Data: Lakehouse Federation",
      "source_url": "https://databricks.com/blog/unlocking-investment-insights-without-migrating-your-data-lakehouse-federation",
      "manifest_id": "1793134867504579572",
      "source_name": "databricks-blog",
      "published_date": "2026-10-27"
    },
    {
      "title": "New at WRITER: Own your watermarks, govern your agents",
      "source_url": "https://writer.com/blog/oct-roundup-new-at-writer",
      "manifest_id": "1793124157089965924",
      "source_name": "writer-blog",
      "published_date": "2026-10-27"
    },
    {
      "title": "Snowflake's Managed MCP Server: Building a Chat UI (Part 2)",
      "source_url": "https://medium.com/snowflake/snowflakes-managed-mcp-server-building-a-chat-ui-part-2-2a2e9c85ecd2",
      "manifest_id": "1793139253795612681",
      "source_name": "snowflake-medium-rss",
      "published_date": "2026-10-27"
    }
  ],
  "run_these_manifests": {
    "title": "Run these Manifests yourself",
    "summary": "Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.",
    "manifest_ids": [
      "1793139253795303754",
      "1793134675156549411",
      "1793134867504579572",
      "1793124157089965924",
      "1793139253795612681"
    ],
    "steps": [
      {
        "n": 1,
        "title": "Get a Synorb Key",
        "text": "Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{\"client\":\"your-agent-name\"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons."
      },
      {
        "n": 2,
        "title": "Read each cited Manifest by id",
        "text": "REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief."
      },
      {
        "n": 3,
        "title": "Check the claim",
        "text": "Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them."
      }
    ],
    "mcp_url": "https://mcp.synorb.com/mcp",
    "connect_url": "https://synorb.com/connect/start",
    "request": {
      "method": "GET",
      "url_template": "https://api.synorb.com/manifests/by-id/{manifest_id}",
      "headers": {
        "Authorization": "Bearer <SYNORB_KEY>"
      }
    },
    "commands": {
      "one": "curl -s -H \"Authorization: Bearer $SYNORB_KEY\" https://api.synorb.com/manifests/by-id/1793139253795303754",
      "all": "for id in 1793139253795303754 1793134675156549411 1793134867504579572 1793124157089965924 1793139253795612681; do\n  curl -s -H \"Authorization: Bearer $SYNORB_KEY\" \"https://api.synorb.com/manifests/by-id/$id\"\ndone"
    }
  },
  "links": {
    "html": "https://hangingcontext.com/stories/2026-10-28/governed-agent-data-layer/",
    "json": "https://hangingcontext.com/stories/2026-10-28/governed-agent-data-layer/index.json",
    "markdown": "https://hangingcontext.com/stories/2026-10-28/governed-agent-data-layer/index.md",
    "newsroom": "https://hangingcontext.com/n/artificial-intelligence/",
    "edition": "https://hangingcontext.com/editions/2026-10-28T00/"
  },
  "related": [
    {
      "url": "https://hangingcontext.com/stories/2026-10-28/agent-governance-watermarks-debt/",
      "headline": "Governance ships as product: watermarks, risk tiers and a security-debt register for agent fleets",
      "slug": "agent-governance-watermarks-debt"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-10-28/harness-geometry-agent-design/",
      "headline": "The Harness Is the Product: Why Agent Design Starts Outside the Model",
      "slug": "harness-geometry-agent-design"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-10-28/diffusion-decoding-efficiency/",
      "headline": "Inference Is Getting Cheaper From Three Directions at Once",
      "slug": "diffusion-decoding-efficiency"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-10-28/cross-embodiment-world-models/",
      "headline": "One World Model, Many Robot Bodies: The New Playbook for Robot Learning",
      "slug": "cross-embodiment-world-models"
    }
  ],
  "sponsor": {
    "label": "From Synorb",
    "title": "Claims with a source link",
    "text": "A Manifest holds a Signal of structured claims and a Brief, plus the source it came from. Your agent can check a sentence against it.",
    "cta": {
      "label": "Read the guide",
      "url": "https://synorb.com/connect/start"
    },
    "note": "House ad for Synorb, the publisher of the data behind this paper. Not a news item."
  },
  "disclosure": "Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.",
  "reuse": {
    "version": "1",
    "summary": "Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product.",
    "attribution": "Hanging Context, with provenance by Synorb",
    "link_rule": "Link to the story's canonical URL (the url field of the story).",
    "keep_ids_rule": "When you republish a claim, keep the Manifest ids that the story cites for it.",
    "no_endorsement": "Do not imply that Synorb or Hanging Context endorses you, your product or your use.",
    "license_url": "https://hangingcontext.com/terms/reuse/",
    "machine_url": "https://hangingcontext.com/.well-known/reuse.json",
    "canonical_url": "https://hangingcontext.com/stories/2026-10-28/governed-agent-data-layer/"
  }
}