Google’s Data Agent Kit turns a chat thread into a cross-system investigation—but approval is the control plane

Google Cloud’s new Data Agent Kit walkthrough is not just another text-to-SQL demo. The preview connects an IDE agent to multiple data systems through MCP, lets it execute rather than merely suggest queries, and keeps the investigation in one chat session. That broader reach makes the permissions prompt and execution trail the most important parts of the design—not the natural-language interface.

One question, three systems

Google’s example starts with an open-ended question: average order value fell while revenue stayed flat. The agent first queries BigQuery, then switches to a PostgreSQL database in Cloud SQL, and finally reads campaign metadata from Cloud Storage. In the demonstration, those steps identify a newly introduced wholesale channel, new business accounts, and a discount code as the explanation for the blended-metric change.

The practical shift is that users are no longer copying generated SQL into separate consoles. Data Agent Kit exposes MCP servers and editable agent skills inside supported IDEs and command-line tools, including Cursor, Claude Code and Codex. The agent can execute read-only SQL and inspect results across systems from the same thread.

The permission prompt is not friction

Before the first query runs, the IDE pauses for permission to call the required MCP tool. Google’s walkthrough offers a one-time approval for auditing or an “always allow” choice. Practitioners should treat that choice as an operating-policy decision, not a convenience toggle.

The walkthrough also says users can inspect the agent’s execution trail, including MCP calls and raw SQL. That receipt is the minimum review surface for a system that can traverse analytical, operational and object-storage boundaries. Teams should preserve one-time approval for unfamiliar workflows, constrain tools to read-only operations where possible, and review generated SQL before broadening standing access.

A passing build is more useful than a plausible answer

Google then asks the agent to turn the investigation into a dbt project. Its first model fails a uniqueness test because joining customers with multiple pets fans out an order into several rows. The agent reads the failure, rewrites the logic and reruns the build until it passes.

That failure is the most instructive moment in the demo. A fluent explanation did not prove the model was structurally correct; a deterministic data test exposed the bug. Google explicitly cautions that agents can generate large amounts of code while still requiring data-quality checks.

For deployment, the useful pattern is therefore: narrow tool permissions, visible execution receipts, and deterministic tests after generation. Data Agent Kit can reduce console switching and dialect translation. It does not remove the need to decide what an agent may touch—or how its work earns trust.