Google Agentic Data Cloud: who controls what an AI agent can see?

Agent context is an authorization problem, not just a search problem

An enterprise agent needs relevant information, but it must not gain access merely because a connector exists. Google’s November 4 Agentic Data Cloud announcements cover data federation, semantic context and agent-friendly database services.

The announcement groups offerings with distinct release stages. Treating it as one fully available product would blur real buying, policy and rollout decisions.

Separate what is generally available from what remains preview

Google describes AWS and Azure cross-cloud interconnect with caching as generally available, along with access to approved semantic models. It also says its MCP-based Data Agent Kit has recently reached general availability.

Knowledge Catalog’s default integration into Gemini, self-learning enrichment and studio experiences are preview capabilities. AlloyDB Express is in preview as well. Region and edition details still need tenant-specific confirmation, so an organization should document the precise service it can actually enable.

How Knowledge Catalog should respect user identity

Google says Gemini resolves business terms and joins through Knowledge Catalog under each requesting user’s existing access permissions. That is a useful design direction, not an independent audit of every row, column, delegated token or cross-system identity mapping.

The planned automated enrichment from workspace and issue-tracking sources raises new questions: who approves definitions, how are sensitive documents excluded, and can mistaken context be rolled back with an attributable change record? Google identifies new studio review and rollback functions as preview.

Cross-cloud egress promises have narrow boundaries

The launch describes private connectivity and caching for AWS and Azure queries with no variable egress fees for the specified interconnect experience. This should not be rephrased as “all cross-cloud, storage and AI inference costs are free.”

A budget review needs to identify copied or cached data, billing boundaries, storage tiers, model token usage and egress outside the covered route. Confirm residency requirements rather than assuming that federation means data never moves.

Why internal benchmarks should not become procurement guarantees

Google claims that Knowledge Catalog produced nearly four-times higher answer accuracy, up to 33% lower latency and up to 75% fewer tokens in its own benchmarks. Other throughput figures describe particular database configurations rather than universally available service levels.

A reproducible evaluation should score verified domain answers, denied-access requests, generated SQL, total response latency and end-to-end cost across real workloads. The vendor numbers are useful hypotheses, not independent performance outcomes.

An AgentenCode approval matrix for the first pilot

Keep four approvals separate: permissible data sources and regions; user and service identities; context definitions and update governance; and workload budgets. A GA network connection does not turn a preview agent-context component into GA.

Start with synthetic or low-sensitivity records and explicit approval logs. Only broaden the source set after the system demonstrates correct denial behavior, traceable citations and recoverable semantic model changes.

Verdict: governed context is the moat

The announcement underlines the shift from attaching search to an LLM toward maintaining trusted business meaning across systems. The relevant long-term advantage is explainable, permissioned context—not a large connector count by itself.

Teams should ask whether they can prove the origin, permission path and correction history of every consequential agent answer. That is the stronger measure of production maturity.