Most AI tools ask you to trust what happens to your data once a model has seen it. Terazu gives you a switch instead: mark a source metadata only, and no rows or stored values from it reach a model through Terazu, whether the model is the built-in assistant or a tool connected over MCP. AI tools connected over MCP see less still: shape, never content, whatever the setting.

The setting

In Settings › Assistant, an owner or admin chooses: metadata only for the whole workspace, or for individual sources. Every change is recorded, with who made it.

Model data access on the demo: choose what of your data may reach a model. On a metadata-only source, the assistant and connected MCP clients see its metadata (names, structure, SQL, definitions, counts), never its rows, samples or stored values; a governed answer's number goes to the person in its receipt; people in the console are not affected. Data allowed. A box for metadata only, for the whole workspace, unticked. Source by source, 0 of 4 ticked: Meridian IDMC, Meridian Airflow, Meridian POS (Oracle) and Meridian Analytics Warehouse, each data allowed. Save model data access. Only a workspace owner or admin can change this, and every change is audited.
On the demo, Settings › Assistant › Model data access. One switch for the whole workspace, and one per source: here the Informatica org, Airflow, the point-of-sale database and the warehouse. On the demo, every source still allows data. This screen governs the in-app assistant; AI tools outside Terazu get shape, not content, whatever is ticked here.

What a model no longer sees

  • Rows: table previews, samples, searches of records, hops along relationships, and the reads behind checks.
  • Stored values: the highest, lowest and most common values from profiles, drafted descriptions that quote them, measured totals, and the values in pipeline and action records.
  • Computed values: an answer’s number, certified or not.

What it still sees is metadata: names and structure, SQL, definitions and who certified them, lineage, and the counts and shape of a profile. That is enough to explain a number, find where it comes from, or draft a definition.

People keep their answers

An answer on a metadata-only source, certified or not, still reaches the person who asked, in the receipt. The model gets what the question resolved to and a note that the number went to the person. People in the console are not affected at all: roles keep governing what they can read.

The person · receipt
What were net sales for FY2026 P09?
Resolved to Net sales · certified · pin 90aa7e94
4,564,960.60 SARcomputed now, through your agent
source · core.sales_dailycertified by · Priya Sharma
The model 
← resolved   Net sales · pin 90aa7e94  certified  Priya Sharma  source     core.sales_daily  value      withheld  note       the number went to the person
An illustration. One answer on a metadata-only source: the person gets the number in the receipt; the model gets what it resolved to, and a note that the value went to the person.

Told, not tripped

The assistant is told up front which sources are metadata only. If it asks for rows anyway, the refusal names the source and tells it to work from metadata; it carries on rather than giving up on the question. Every read that was refused or withheld is recorded, with the source and the tool.

Column by column

Tables, columns and the definitions they back can carry one of NDMO’s four classification levels. When the secure agent captures a source, it screens for personal data, health data and credentials. A column’s values are kept from any model not marked local when the column is classified Restricted or above, or when screening flagged it and nobody has decided yet.

AI tools outside Terazu

Claude Code, GitHub Copilot, Cursor and any other MCP client connect with an AI-client key that an owner or admin creates. Whatever the settings above, they see shape, not content:

  • What they get: names, types, keys, lineage and counts.
  • What they never get: a row, a cell value or a business figure, such as a sum, an average, a ratio or a Measure’s result.
  • Answers come as a link. They get how the question was read, any refusal with its reason, and a link to the receipt. The figure opens for the person who opens the link, never for the model.
  • SQL leaves with its literals replaced by stand-ins, and a floor masks ID numbers, IBANs, cards, emails, mobiles and credentials.
  • Every outside call is recorded, and you can run the leak test yourself. They can’t certify or change anything.

An owner may allow figures for Measures that are Public all the way down. That workspace setting is off by default.

Where the line is

  • It governs what reaches a model through Terazu, not what people copy elsewhere.
  • Text is metadata. Descriptions people write, and SQL captured from your sources, pass to the assistant as written; to an AI tool outside Terazu, SQL leaves with its literals replaced. Query history is text too, which is one reason it’s read only on connections where a person turns it on.
  • It follows the connection, not the server. Two connections to one database are two sources; set both.
  • Copies follow where they land. Data moved into another source takes that source’s setting.

If no data should leave your network at all, Terazu can also run with a model on your own servers. Local models only is one install-wide setting, and every outbound connection is listed.

Keep reading Who may ask what Anatomy of a receipt Security and deployment