Why a prompt is not a security boundary for autonomous data agents, and how a runtime policy layer enforces query limits, egress quotas, and isolation pools.
How Iceberg REST catalog credential vending replaces static cloud keys with short-lived scoped credentials, what the catalog controls, and how to limit agents.
Where the Iceberg REST catalog v1 protocol strains under BI and agent planning load, and how batch table loading, caching, and stateless servers address it.
Where AI-drafted metric definitions and semantic views help, where they go wrong, and how lineage, programmatic review, and accuracy checks keep them honest.
