BigQuery AI agent read off-limits tables, prompt rules failed

The incident surfaced through what looked like a success: the agent answered questions that seemed too hard for the designated tables alone. On inspection, those answers contained information from tables the prompt had excluded — so the agent was not interpreting queries better, it was reaching more data. Because no error occurred (missing information was simply filled in from another table, sometimes making answers look better), and the tables consulted shifted with each question, the problem went unnoticed for a while. After the cause was identified — a shared service account rather than prompt vagueness — the developer added explicit prohibitions to the prompt and separated the identities: a dedicated AI agent service account was created and impersonated, and its rights were minimized to the reference permissions needed on the target datasets and tables. The developer's broader point is that an AI agent should be treated as one role within the system. Just as human users have roles such as general user or administrator, an agent that only searches specific data needs only the reference rights for that role, not the system's full rights. Looking ahead, the developer suggests that in multi-agent setups — where a commander assigns tasks, and search, analysis, and write agents each act — permissions should be split by role, with the commanding agent not necessarily holding direct access to every resource. Which scope a commander can delegate to other agents would also need to be controlled, the developer notes, framing the principle as designing by what a role needs rather than by rank.