Wren AI SecuritySECURITY

Governed GenBI, from prompt to SQL.

Wren AI puts identity, semantic policy, query execution, and auditability in the path of every answer, whether the caller is a teammate, an embedded app, or an AI agent using MCP.

Talk to security Read security docs

The governed path

Every question, one governed path

01 · Ask

A question arrives

From a person, an app, or an AI agent.

UISlackAPIMCP

02 · Identify

Caller is resolved

OIDC identity plus session properties like role and tenant.

role: analysttenant: acme

03 · Enforce

Policy is applied

Wren Engine rewrites the query with semantic, row, and column rules.

Semantic modelRLSCLSSQL guard

04 · Execute

Governed SQL runs

In your warehouse — data never moves.

WHERE tenant = 'acme'

Every step is recordedWho asked, session context, generated SQL, result path.

Policy point

Semantic layer

Metrics, relationships, joins, and permission rules live in the governed Wren AI context layer.

Every caller

UI, API, MCP

One control path applies to dashboards, embedded analytics, Slack, Teams, and agent clients.

Deployment

Cloud to air-gap

Run in Wren Cloud, your private cloud, your own infrastructure, or an air-gapped environment.

01Mechanisms

Security claims you can trace through the product.

Every security claim maps to a visible Wren AI mechanism: identity, semantic policy, execution controls, agent boundary, deployment boundary, and audit evidence.

02Security architecture

The control plane sits before the query runs.

Wren AI does not treat governance as a review step after an answer is produced. The request is resolved through identity, project permissions, semantic definitions, row and column controls, SQL validation, and audit logging before results reach the user.

OIDC and workspace roles identify who is asking.

The MDL semantic layer constrains metrics, joins, and business logic.

RLS and CLS are applied at query time before execution.

SQL and answer lineage are recorded for review.

Inside the policy check

How a prompt becomes governed SQL

01 · The request

“Show Q4 revenue by region”

Session properties are resolved from OIDC — not supplied by the prompt.

user: dana@acme.comrole: analystregion: EMEA

02 · Wren Engine

Policies applied before execution

Row filters, column masks, approved joins, and bound parameters — SQL injection is structurally blocked.

RLSCLSMDLSQL guard

03 · Governed SQL

WHERE region = 'EMEA'

The row filter is injected from session context; values are bound, never string-pasted.

Enforced on every surfaceChat, charts, previews, spreadsheets, API, and MCP.

03Agent governance

Expose data to agents without bypassing controls.

MCP makes Wren AI available to agentic tools, but the agent does not get a side door to the warehouse. Claude, Cursor, custom copilots, Slack, Teams, embedded apps, and API callers resolve through the same governed endpoint.

One MCP and API boundary for humans and agents.

Reusable skills and memory stay grounded in the semantic model.

Every agent request inherits project access and data controls.

Generated SQL remains inspectable instead of hidden in a black box.

Agent governance

One door for every caller

01 · Callers

People, apps, and AI agents

Wren UI, Slack, Teams, Claude, Cursor, embedded apps, and API clients.

UISlackClaudeCursorMCPAPI

02 · Boundary

Wren AI governs every request

Same permissions, RLS + CLS, semantic model, and audit for humans and agents alike.

03 · Data

Your data sources

Only governed, inspectable SQL reaches BigQuery, Postgres, Snowflake, and 20+ more.

No direct accessNo caller — human or agent — connects to the warehouse directly.

04Data residency

Keep Wren AI inside the boundary you trust.

Use Wren AI as managed cloud, private cloud, self-hosted infrastructure, or fully air-gapped deployment. Connect to your existing warehouse and operational sources without rebuilding pipelines or migrating sensitive data into a new analytics silo.

Connect to 20+ data sources where they already live.

Bring your own LLM for tighter data and model control.

Project isolation keeps tenants and business units separated.

Audit logs help prove who asked what and which query ran.

Data residency

Run Wren AI inside your boundary

MANAGED

Wren Cloud

Fastest start

YOUR VPC

Private cloud

Your network rules

YOUR INFRA

Self-hosted

Full-stack control

OFFLINE

Air-gapped

No external egress

Your data stays where it lives20+ connectors — no migration, no copies. BYO LLM supported.

05Control surface

Built for the review your data team actually runs.

Identity, permissions, semantic policy, query controls, deployment choice, and evidence, organized as controls your security team can inspect.

Identity and access

Connect Wren AI to your identity provider with OIDC, assign workspace and project roles, and keep access reviews aligned with existing enterprise governance.

Row and column controls

Apply row-level and column-level security in the governed query path so sensitive records and fields are filtered before users or agents receive results.

Semantic guardrails

Define metrics, relationships, calculated fields, and business terms once in MDL so prompts resolve through approved logic instead of improvised joins.

Auditability

Review activity logs, generated SQL, project usage, and answer lineage to understand who accessed data and how a number was produced.

Deployment control

Choose Wren Cloud, private cloud, self-hosted, on-prem, or air-gapped deployment based on your security and procurement requirements.

Agent-safe APIs

Serve the same governed context to Wren UI, embedded apps, Slack, Teams, APIs, and MCP clients without duplicating policy logic per channel.

Security walkthrough

Bring agentic analytics to security review.

Show your security, platform, and data teams how Wren AI keeps natural-language analytics inside a governed execution path.

Book a security walkthrough Compare plans