Data Console: Asking Questions in Plain English

Ask lets someone who does not write SQL get an answer from the database, without loosening any of the governance around it. It uses your own provider key — DBShifts never supplies or bills for one — it is off until you switch it on per source, and it can only read what you could read, masked exactly as it would be masked for you.

Before you start

Your own Anthropic or OpenAI API key. It is stored encrypted, the same way a database password is.
A conscious decision to enable it per source: answering a question sends the rows needed to your provider.
A monthly token cap you are comfortable with — it is your provider account being billed.

Steps

1
Add your own AI provider key in Console Settings — Anthropic or OpenAI. DBShifts never supplies or bills for one; the key is encrypted at rest like a database password
2
Open a data source and click Ask, then enable it for that source. It is off by default, because answering a question sends the rows needed to your provider
3
Ask something like 'which customer spent the most?' — questions spanning related tables work, and joins follow your real foreign keys, so a relationship can never be invented
4
Every answer shows its lookup trail: which tables were read, how many rows, and whether anything came back masked. Grouped results are charted automatically
5
Click 'Save this query' on a good answer to keep it as a saved query — Ask can run it again by name later
6
Ask follow-ups: 'and last month?' keeps the context of the previous answer without re-sending the rows
7
Set a monthly token cap in Settings (defaults to 2,000,000). It is your provider account, so the cap is what stops a mistake becoming a surprise bill

What goes wrong

Data does leave your infrastructure — that is the trade

Answering a question means sending the relevant rows to your provider. That is why it is opt-in per source, labelled, and audited like any other data access. If that trade is unacceptable for a source, leave it off; everything else in the Console keeps working.

Masked stays masked

Ask reads through the same masking and permission rules as browsing. It cannot see a column you cannot see, and the answer says when a value came back masked rather than quietly working around it.

Joins follow real foreign keys

Relationships come from the schema, not from a model's guess about which columns look related. A join that does not exist in your database cannot be invented to satisfy a question.

Nothing here touches a migration

Schema conversion, masking and validation stay deterministic and rule-based. Ask is a reading tool in the Console; it is not in the path of anything that writes to a database.

Data Console: Browsing a Database Safely

Give people access to production data without giving them production credentials, with PII masked unless explicitly granted.

Agent Gateway: Connecting an AI Agent

Give an AI agent a scoped, audited door into a database — structured tools instead of raw SQL, with writes gated behind approval.