We let a model near our warehouse. Here is what we locked down first.

The first question every security team asks is the right one: what stops this thing from reading a table it should not?

Read-only, always

Sable connects with read-only credentials and refuses to start if it is given anything wider. There is no code path that writes to a customer warehouse, which makes the review short.

Permissions come from your warehouse

We do not keep a second copy of who can see what. Every query runs under the asking person’s identity, so row-level policies already in Snowflake or BigQuery apply unchanged. If someone cannot see a salary column there, no phrasing of a question will surface it here.

Nothing is used for training

Your schemas, your rows and your questions never enter a training set, ours or a vendor’s. That sits in the contract rather than in a blog post, which is the only place it counts.

Everything is logged

Every question, the query it produced, the tables it touched and who asked, kept for as long as your retention says and exportable to your own store.