# How to give AI-built tools access to company data, safely > On Substrait, a tool reads company data only after the data owner approves it, for a set time, through a gateway that holds the credential and records every read. URL: https://substrait.build/problems/give-ai-built-tools-access-to-company-data-safely/ Last updated: 2026-11-06 **The question:** Our people's AI-built tools need our ERP and warehouse data. How do we grant that access safely? Grant data to the tool, not just a connection. On Substrait, the owner of each set of data approves each tool's access for a set time, the tool never holds the credential, and Substrait records every read with the tool and the person behind it. ## Why this is hard Reaching a private system is no longer the hard part. Most AI models can now connect to a database or an API through a tunnel or a key. The hard part is control: who allowed this tool to read this data, for how long, and what did it read? A key pasted into a tool answers none of those questions. ## What Substrait does **Data is grouped, and each group has an owner.** An admin puts APIs, data sets and fields into data groups, such as finance or operations. Each data group has a data owner, who decides every request for its data. **Seeing and reading are two separate grants.** Enrolment lets a person see which data exists and its shape, with no records. Authorisation lets a person or a tool read the data, once the data owner approves. **A tool gets its own grant.** A tool's access is approved separately from its builder's access. It can never be wider than what the person who asked for it is enrolled to see. An approved grant stays with the tool when its owner leaves. **Every grant expires.** Authorisations last for a set time, then the person or tool asks again. A data owner can also cap how often a tool may call, so a runaway tool slows down instead of stopping others. **One gateway for every source.** Every call a tool makes to company data goes through Substrait's gateway. The gateway checks the grant, attaches the credential and records the read. An ungranted call is refused with the name of the missing grant. Outbound traffic from a tool is denied unless a grant allows it. ## What a tool can reach this way | Source | How Substrait reaches it | |---|---| | Your systems' APIs | Registered in the API Library, opened to a tool only after the data owner approves | | Tools built on Substrait | Each tool's API joins the library, closed until a data group grants it | | Your data warehouse | Reviewed, parameterised and versioned data sets, never raw queries | | Your reporting tools | Saved queries read through Substrait, with no reporting-tool key in the tool | | Business systems | Connectors for SAP, Salesforce, Oracle, NetSuite and the Microsoft stack |
Substrait console: data groups, each with its owner and the APIs and data sets it covers.
Data groups, each with a data owner. Product UI. Sample data.
## Questions and answers ### Can AI-built tools reach an ERP such as SAP or Oracle? Yes. Substrait connects tools to business systems such as SAP, Salesforce, Oracle, NetSuite and Microsoft Dynamics 365, and to the company's own APIs, data warehouse and reporting tools. The reach is not the hard part. The grant is: on Substrait the data owner approves each tool's access, for a set time, and every read is recorded. ### Does the builder see the database password or API key? No. Substrait holds every upstream credential, encrypted and write-only. The tool calls through Substrait's gateway, and the gateway attaches the credential. Neither the builder nor the data owner ever handles one. ### What happens when access is withdrawn? A withdrawn grant refuses the tool's very next call. No redeploy is needed. ### Can a tool read more than the person who built it? No. A tool's access can never be wider than what the person who asked for it is enrolled to see. ## Related - [Company data, granted by its owner](https://substrait.build/capabilities/governed-data-access/): A tool on Substrait reads company data only after the data owner approves it, for a set time, through one gateway that holds the credential, checks every call and records every read. - [One catalogue of the APIs and data your tools can use](https://substrait.build/capabilities/api-library/): Substrait's API Library lists your company's APIs, the tools your people built and your warehouse data sets. Builders browse it in conversation with their AI model, and see only what their groups allow. - [Right-sized authority for every person](https://substrait.build/capabilities/roles-and-access/): Substrait keeps four kinds of access apart: data groups for what a person may see and read, capability groups for what they may do on the platform, app roles for what they may do on one tool, and each tool's own sign-in. - [An audit trail nobody can alter](https://substrait.build/capabilities/audit-trail/): Substrait records every access and action in an audit trail that nobody, a platform admin included, can change after the fact. It is queryable, exportable to your security monitoring, and kept in storage you control.