AgentQ Access Controls

A Manager or Admin decides how much of your data AgentQ is allowed to send to the configured AI provider. There is one setting, and it applies to the whole deployment rather than to individual users or teams.

These controls answer a question that comes up in most security reviews: can we turn AgentQ on without letting values from our data reach a model? The answer is yes, and the setting that does it is described below.

To change it, see Configure Access Controls.

AgentQ works by calling tools, which are named operations that map to Qualytics capabilities. Every tool is classified by the most it can send to the AI model, and the setting is that same classification: your administrator chooses how far down the classification AgentQ is allowed to reach.

That is the whole control. There is no separate switch for individual assistants or features, because each one is simply a set of tools at a given classification. Turning a level off turns off everything classified at that level, wherever it appears in the product.

The levels are cumulative. Each one includes everything above it, so they form a single scale rather than a set of independent switches.

Level	What AgentQ may send to the model	Configurable
Nothing about your data	Nothing about your data at all. Static guidance, rule type catalogs, User Guide content, and validation errors.	No. Included automatically.
Metadata shared	Everything in Nothing about your data, plus information about your data: names, schemas, data types, descriptions, tags, row and anomaly counts, quality scores, timestamps, and quality check definitions. No values from your data.	Yes
Source data shared	Everything in Metadata shared, plus individual data values from source datastores.	Yes

The same levels appear in the Data column of the Tool Catalog, which lists the level assigned to every individual tool.

Two names for each level

The cards on the Access Control tab read Nothing about your data, Metadata shared, and Source data shared. The tool catalog and the messages AgentQ returns when a step is withheld call the same three levels No Sharing, Metadata Shared, and Source Data Shared. A message such as Golden-record recommendations needs Source Data Shared refers to the Source data shared card.

Nothing about your data is automatic. Configuring an AI provider carries it, and there is no setting to remove it. An assistant that cannot reach its own guidance and rule catalogs has nothing useful to do, so that combination is not offered. To make AgentQ unavailable entirely, remove the AI provider. See Remove Integration.

Three things hold at every level:

No tool sends your records in bulk. Nothing hands the model rows, result sets, or sample records. At the Source data shared level, values reach the model singly and incidentally, in the same way a steward sees a value when reading why a check failed.
Masked field values are never sent to the model. Masking is yours to control and AgentQ respects it at every level. See Masked Fields.
Credentials are never sent. Connection details and secrets for your datastores and integrations never reach the model.

What Each Level Unlocks

Because the level is the only setting, every AI capability follows from how its tools are classified. Nothing below is separately configurable. On the Access Control tab of the AgentQ settings, each level is a card, and under it the capabilities that level adds are listed as previews of the screens they appear in, each named and placed, so the choice is an informed one.

Nothing about your data

Capability	What it does
User Guide answers	Answers that quote the User Guide back to you.
Rule catalog	Rule explanations while picking a check type.
Data quality guidance	General guidance, with nothing about your assets in it.

These three are what every provider can do, so they are included at every level and have no switch.

Metadata shared

Capability	What it does
Check Assistant	Proposes a quality check from asset metadata on the check authoring form.
Template Assistant	Proposes a check template on the template authoring form.
Description suggestions	Suggests descriptions for platform assets.
Quality-score recommendations	Explains quality scores and recommends ways to improve them.
Chat starter suggestions	Suggests opening prompts in the chat interface.
Questions in chat	Exploring your inventory, reading check definitions, running operations, managing anomaly status, and assessing whether an asset can be trusted. The trust assessment weighs scores, counts, and definitions, never values.
Recipe AI steps	Entity key and match field suggestions, dry run analysis, and scan result interpretation. These send statistics and counts, never values.

The two authoring assistants can only propose a definition for you to accept, never save one. Every tool they can reach is classified at Metadata shared or lower, which is why they follow this level and why neither can send an individual data value whatever the setting is. When a capability here is unavailable, the sparkle that opens it is hidden and the feature falls back to its standard, non-AI behavior.

Source data shared

Capability	What it does
Golden-record recommendations	Choosing which record in a duplicate group to keep. The records themselves are sent to the model, which is why this step needs this level.
Anomaly investigation	Reading why a check failed, including the value behind the failure, and the anomaly's history.
Field profile statistics	Profile figures that include real values, such as minimum and maximum.
Checking records you supply	Validating records you provide against a container's active checks.
Anomaly comments	Comment text is written by people and can quote records, so it is treated as source data.

Recipes remain usable below this level. Their other AI steps (entity key and match field suggestions, dry run analysis, and scan result interpretation) send only metadata, so they sit at Metadata shared and keep working. Only the golden-record step is unavailable, and it says so rather than quietly offering a weaker answer.

When an AI step is unavailable

Two different situations look similar and behave differently on purpose:

No AI provider is configured. Features that have a non-AI equivalent quietly use it. Most recipe steps, for example, fall back to suggestions Qualytics computes without a model.
A provider is configured but the level does not cover the step. The request is refused and says so. It is not answered with the non-AI equivalent, because presenting a weaker answer as the best available would hide the fact that a capability was withheld.

What Users See

An administrator sees each level's effect before choosing it, because the Access Control tab lists, under every level, the capabilities it adds as small previews of the screens they appear in, from the assistant panel in the check editor to the floating chat.

When someone reaches a capability that has not been enabled, AgentQ says so plainly. The message names both the level that would restore the capability and your administrator as the person who sets it, so the user can say exactly what they need rather than describing a symptom. A message of that kind is a configuration decision, not an error, an outage, or a problem with the person's own account.

This is deliberately different from a permissions message. If AgentQ tells you that an action is not permitted, that is about your own role and team permissions, and the remedy is a change to your access. If AgentQ tells you that a capability needs a level your Qualytics Administrator has not enabled, your access is not the issue and the remedy is a conversation with whoever manages the deployment.

AgentQ also knows which capabilities are unavailable before you ask. Rather than attempting a blocked action and reporting a failure, it works within what is enabled and tells you when something you asked for is outside it.

Defaults and Scope

Everything is enabled by default. A deployment that has never opened these settings behaves exactly as it did before they existed, and upgrading changes nothing until an administrator makes a choice.

Changes take effect on the next message. There is no need to restart anything, and conversation history is preserved when the setting changes.

Some things this control deliberately does not cover:

External AI clients. When you connect your own AI client over MCP, your client brings its own model and no Qualytics AI provider is involved, so this setting does not apply to the existing tools on that path. The semantic reporting tools query_qualytics and describe_query_schema enforce the deployment's sharing level on their queries and schema discovery. Access there is governed by the connecting user's own role and team permissions.
Team permissions. This control sits alongside permissions rather than replacing them. Every tool still runs as the signed-in user and still checks that user's team permissions, so raising the level never grants access to a datastore someone could not already reach. See AgentQ Permissions.
The rest of the platform. Lowering the level restricts what AgentQ can send to a model. It does not change what any Qualytics feature does outside AgentQ, and it does not change what any tool returns to a user in the app.
Safety behavior inside a conversation. The topic guardrail and the automatic summarizing of long conversations are part of how a chat turn works and are not configurable. Turning either off would weaken the deployment rather than restrict it.