The guarantees

These are the contracts ObeliskDB enforces on every caller — Obi, an external agent over MCP, a human at the console. Each is structural: enforced in the executor, not requested in a prompt. That distinction is the whole point. A rule in a prompt is advisory — the model can ignore it, injected data can override it, a new session can lack it. The same rule in the engine is non-negotiable.

The six guarantees

Guarantee	What it means	How it is enforced
Meaning	One canonical definition per quantity	A governed metric the agent invokes by name; the definition is executed, not recalled
Isolation	Writes never hit live data by accident	Auto-staged on a zero-copy branch; a human reviews the diff and merges
Receipts	Every answer replayable and citable	Immutable history keyed to data versions; time travel reconstructs any past answer exactly
Economics	A hard ceiling on agent spend	A per-session credit budget charged at execution; statements refused once spent
Memory	Durable conclusions that know when they are stale	Insights pinned to data versions, permission-checked on read, freshness computed from the version chain
Confidentiality	Sensitive columns stay sensitive under attack	Masking applied inside the scan rewrite, so even a `WHERE` filter sees masked values

Each of these is measured, advisory-versus-enforced, in the whitepaper's evaluation. See the whitepaper.

Authority-path controls

The six above bound an agent's blast radius — what it can break once it acts. A second, sharper class bounds the authority path — how an agent is allowed to ask, and whether it can be steered by what it reads.

Compelled governance

A session can be restricted to metrics and insights only. Raw table reads, DML, and DDL are refused in the executor.

ALTER SESSION SET GOVERNED_ONLY = TRUE;    -- raw SQL now refused
SELECT * FROM TABLE(METRIC('revenue'));    -- still works

Launch a governed external agent over MCP with OBELISK_MCP_GOVERNED=1. When imposed on an agent the flag is locked — the agent cannot ALTER its way out. This closes the raw-SQL escape hatch: an agent that cannot emit raw SQL cannot misdefine a quantity or reach an ungoverned column, whatever it is told.

Injection resistance

An agent session refuses irreversible and privileged operations outright — DROP DATABASE/SCHEMA/USER/ROLE/WAREHOUSE, CREATE USER/ROLE/WAREHOUSE, GRANT, REVOKE, ALTER USER, VACUUM, MERGE BRANCH, UNDROP — no matter what a data cell instructs. Ordinary writes still stage on the branch; only these bypass-the-branch operations are blocked, and a human runs them in the console. This is the defense against indirect prompt injection: a "drop the database" hidden in a row has nothing to act on.

Inference control

A table can require that aggregates cover a minimum cohort, defeating reconstruction of individual values by probing tiny groups (the classic statistical-database attack):

ALTER TABLE HR.EMPLOYEES SET AGGREGATION THRESHOLD = 5;
-- an aggregate qualifying fewer than 5 rows is refused

Everything the caller does is on the record

Every statement is logged with its accessed objects and versions, its cost, and (in an agent session) the exact redirected SQL that ran. SHOW AGENT SESSIONS is the audit trail; the control plane's Review queue shows every staged change before you approve it.

Determinism as a dial

Reproducibility is not all-or-nothing. ObeliskDB lets each question choose the guarantee it deserves:

- Flexible — ad-hoc SQL. Maximum expressiveness, no reproducibility guarantee. Correct for exploration.
- Defined — a governed metric. The same definition every time, any dimension.
- Pinned — a materialized insight. Byte-identical on every read until the inputs change, and then it says so.