senti Home · The governance paper Get the paper
White paper · v2.0 · July 2026

Why Direct LLM Access to Enterprise Data Is Risky

The case for a governed intelligence layer between language models and enterprise data. Written for the people being asked to approve it.

Jason Pugh · Chief Executive Officer and co-founder
Rayson Technologies, LLC · Huntsville, Alabama
12 sections · 4 figures · 25 references

the argument, in one receipt:
accuracy falls from 86% on clean academic schemas to 10.8% on private warehouses
the failure mode is a confident wrong number, not an error message
the operator owns the output, whichever system produced it
senti Get the paper

29 pages, no gate on the references. Business email, and it downloads on this page.

No call follows unless you ask for one.

1What is inside.

Twelve sections. Use it on a vendor, or on the layer you are building yourself.

The benchmark record
Four benchmarks, from clean academic schemas to private warehouse query logs. 86 percent down to 10.8 percent.
Six failure modes
The errors that return a clean number, a plausible figure, and no error message.
Protocol is not governance
Eight protocol concerns, and what each one leaves to the implementer.
A reference architecture
Four layers, and nine capabilities that define the governed layer. Each one testable.
Twelve evaluation questions
Each one with a demonstrable answer. A roadmap answer is a no.
A five-phase sequence
One domain at a time, with a written gate before each phase closes.

2The accuracy problem is measured.

Accuracy does not degrade gradually as data gets more realistic. It falls off a cliff.

Fig. A · best reported execution accuracyAcademic · Enterprise
Spider 1.0 · 2018 86%
BIRD · 2023 80%
Spider 2.0 · 2025 21%
BEAVER · 2024 10.8%
Spider 1.0: small, clean, curated schemas. BIRD: 95 real databases, dirty values, 37 domains, against 92.96% human expert. Spider 2.0: 632 enterprise workflows, 1,000+ columns, multiple dialects. BEAVER: 9,128 pairs from private warehouse query logs, 812 tables, using a frontier model in an agentic framework. 1

Five conditions drive the collapse, and only one of them gets better with a larger model: schema scale, encoded and dirty values, definitions that live outside the database, dialect variance, and no training signal for a warehouse that has never been public.

Supplying per-question domain hints moved one frontier model from roughly 35 to roughly 55 percent. That gain is the measured value of knowledge nobody wrote down.

3The silent wrong answer.

Every error below produces a query that runs cleanly and returns a number that looks reasonable. This is the failure mode that should decide the architecture.

01

Join fan-out.

A fact table joined to a many-to-many bridge without deduplication multiplies rows and inflates every sum. Revenue doubles. Nothing errors.

02

Grain mismatch.

Summing a monthly snapshot column across daily rows, or summing a pre-aggregated measure at the wrong level.

03

Missing mandatory filter.

Omitting a soft-delete flag, a test-account exclusion, or a fiscal calendar restriction.

04

Average of averages.

The mean of per-region averages rather than a weighted mean, which quietly reweights the entire result.

05

Slowly changing dimension errors.

Joining a type-2 dimension without effective-date predicates, so historical figures shift every time a record changes.

06

Time zone and fiscal boundary drift.

Bucketing by UTC when the business reports on local fiscal periods, which moves revenue across period boundaries.

None of these are exotic. They are the ordinary hazards of analytical SQL, and they are precisely the hazards a data team spends years encoding into curated models so nobody has to rediscover them. Direct access discards that work on every query.

4Protocol is not governance.

An integration standard solves interoperability, and interoperability is not trust. Four of the paper's eight concerns:

Identity
Nothing binds a session to a verified identity. Authentication is optional in the protocol, so all of it is left to the implementer.
Business semantics
Nothing. Metric definitions, join paths, grain, and permitted aggregations are the implementer's problem.
Query validation
Nothing. Static checks, fan-out detection, cost bounds, and a prohibition on writes are all added by whoever builds the layer.
Determinism
Nothing. Identical prompts can produce divergent behaviour across implementations.

senti is Rayson's implementation of the governed layer this argues for. It holds the semantic contract, compiles and validates SQL before execution, executes read-only, and files the lineage for every request. 2

5Four of the twelve questions.

Ask them of a vendor, including us. Each one should have a demonstrable answer.

01

Ask the same question ten times. Is the generated SQL byte-identical each time?

04

Ask something it cannot answer from governed definitions. Does it refuse and explain, or does it guess?

08

Produce the lineage record for a single answer. Does it include identity, contract version, compiled SQL, and row count?

12

Show a case where the layer was wrong. A vendor that cannot produce one has not looked.

The remaining eight are in section 9 of the paper, together with the five-phase sequence for standing the layer up one domain at a time.

6Bring us the question you can't currently defend.

Two ways to start, both of them short.

A scoped proof

One metric you cannot currently defend, run against your own warehouse. You keep the trace: the question, the SQL, the result, and the record.

A governance review

One hour. Your architecture walked against the twelve questions, with a written note on where the evidence is thin.

Book the hour Read the hard questions

1 Published accuracy figures are point-in-time; leaderboards move. The paper carries all 25 references with dates and links.  2 The paper describes architectural patterns and cites publicly available research and guidance. It is not legal advice.