Analytics agents are leaving the chat window—so approval has to move into deployment

Three enterprise analytics releases this week point in the same direction: the durable product is no longer a chat answer. It is an agent task, saved query or workflow that can run again without reconstructing the original conversation. That changes where teams need to put human approval.

Databricks’ generally available Genie Code task can run a natural-language prompt inside Lakeflow Jobs, consume upstream outputs and call tools. Its documentation says auto-approval is always enabled for job tasks, while an AI classifier checks whether an action appears consistent with the prompt. Databricks also warns that this classifier is a productivity feature rather than a security boundary. In other words, the meaningful review happens before the job is deployed: which identity runs it, which MCP connections it inherits and what upstream text it is allowed to consume. Source: Databricks

Google’s Gemini data workflow creates a different durable artifact. A user can ask for a report in natural language, inspect the generated query and save it for later reruns without new model-token charges. The saved query is more predictable than regenerating SQL each time, but it can also outlive the context in which an analyst first checked it. Google says agents receive their own identities and actions are attributed in audit logs; teams still need an owner, version history and reapproval trigger when schemas or business definitions change. Source: Google Cloud

ThoughtSpot’s AgentSpot makes the same transition at a broader workflow level. Its agents, scheduled or triggered workflows and apps are designed to be shared as company assets. The platform also has company, agent, user and agent-user memory layers, while creator changes to agent memory propagate to people using that agent. That makes publication and memory promotion—not the first conversational turn—the consequential governance events. Sources: ThoughtSpot launch and product page

Replace prompt approval with promotion gates

The common operating model is a promotion pipeline. Keep experimentation flexible, but require review when conversational work becomes recurring infrastructure:

1. Classify the artifact: saved SQL, scheduled agent job, shared workflow or promoted memory.
2. Bind a narrow identity: grant only the data and actions that artifact needs.
3. Test hostile and stale inputs: include malformed upstream output, changed schemas and instructions embedded in retrieved text.
4. Record provenance: preserve the prompt, generated query or workflow version, approver and tool calls.
5. Set a reapproval trigger: permissions, models, schemas, business definitions and connected tools can all change the behavior of a previously accepted artifact.

This pattern does not make chat review irrelevant. It makes one-time approval insufficient. As analytics agents become repeatable infrastructure, governance has to follow the thing that runs—not the conversation that created it.