Layer: Semantic layer
fingerprint linking back to the immutable audit row. The agent never
writes SQL itself for declared metrics — SchemaBrain compiles and
parameter-binds.
group_byandfiltersuseentity.columnform (e.g.plan.title,invoice.issued_at) — never physicalschema.table.column.filtersis(column, op, value)with closed-set ops:eq,ne,lt,lte,gt,gte,in,not_in,is_null,not_null.- Values bind as parameters — never inlined into SQL.
fan_out_join_namesflags joins where the cardinality could inflate rows. When the list is non-empty the envelope downgrades tostatus="degraded"withconfidence="MEDIUM"— this is the machine-readable signal the agent should surface to the user, not the list itself.pii_categoriespropagates the MAX-sensitivity + UNION-categories of every column touched, and is what--pii-blockfilters against.
list_entities instead when you don’t yet know what’s defined.
get_metric only computes pre-declared metrics — it will never run
arbitrary SQL.