BigQuery lets you run read-only analytics over the tables a connected service account can see — not a person's full cloud access.
Connect a dedicated service account, grant it Job User on the project, and give Data Viewer only on the datasets or tables you want exposed. Anything you do not grant stays invisible. Queries use the GoogleSQL dialect. Result sets stop at max_results so a wide table cannot flood the conversation.
What you can do
- list_datasets — see which datasets the connected account can access
- list_tables — list tables in a dataset
- get_table_schema — inspect columns, types, and row counts before querying
- run_query — run a GoogleSQL SELECT, optionally as a dry run or with a bytes billed cap
Who it's for
Data teams who want an agent to query the warehouse without sharing a user's cloud login. Especially useful when only a curated set of tables should be visible.
How to use it
- Start with list_datasets to see what the connected account can reach
- Call list_tables with a dataset id, then get_table_schema to learn columns
- Call run_query with a GoogleSQL SELECT. Set dry_run to estimate bytes scanned, or maximum_bytes_billed as a hard cap
- If truncated is true, add filters or raise max_results (up to 1000)
Getting started
Connect a BigQuery service account, then start with list_datasets. Grant Job User on the project and Data Viewer only on the tables you want exposed.
