Denodo and AWS demonstrate governed agent access to distributed enterprise data

AWS Machine LearningOct 20, 2026

An AWS technical walkthrough shows Denodo connecting an AgentCore-hosted agent to governed customer data across Aurora, Redshift and on-premises PostgreSQL.

An AWS technical walkthrough published October 20, 2026, details how Denodo Platform can provide an Amazon Bedrock AgentCore-hosted agent with governed access to data in Amazon Aurora, Amazon Redshift and an on-premises PostgreSQL database. The example uses a customer 360 view, combining profile, order and rewards information without first copying the source data into a single store.

In the demonstration, Denodo’s Virtual DataPort federates queries across the three systems, while the agent communicates with Denodo through its MCP Server. A foundation model on Amazon Bedrock plans queries in Denodo’s VQL dialect. The walkthrough identifies Anthropic Claude Sonnet 4.6 as the model used in its example. Denodo decides how to execute parts of a query against each source and combine the results; one illustrative question asks which high-spending customers have not enrolled in a rewards program.

The architecture also passes user identity through the request. AgentCore Gateway receives the user’s authenticated request, and AgentCore Identity exchanges the user token for a scoped credential for Denodo. Denodo then maps the caller to a role and applies access policies when the query runs. The model’s prompt is not responsible for defining joins, business metrics or permissions; those rules reside in the semantic layer.

The post demonstrates column masking using personally identifiable information as an example: a marketing user sees masked Social Security and card numbers, while an authorized HR role can see the unmasked values. It also describes row-level filters and audit records across the agent, gateway and Denodo components. These controls apply to data returned through the semantic layer, while the article cautions that generated responses may still contain sensitive details and need appropriate handling.

This is an implementation walkthrough, not a report of a production customer deployment or measured business outcomes. AWS describes two Denodo deployment options: the managed Agora service or a self-managed installation on Amazon EC2 or Amazon EKS. The pattern is presented as a way to connect agents to distributed enterprise data while keeping query logic and access controls defined centrally.

Industry Impact

Governed access for enterprise agents

Enterprise IT, data management, customer operations, marketing and HR

Overview

The walkthrough shows how teams can let agents query customer data across cloud and on-premises systems without consolidating it first. For developers and data teams, Denodo’s semantic layer centralizes query logic; identity-aware roles and masking give security and compliance teams controls at the data-access point. Near term, organizations can use the pattern to evaluate agent access to distributed data. Longer term, centrally managed rules could make it easier to extend agent use cases while retaining existing source systems and access policies.

Key Impact Points

Federated queries combine Aurora, Redshift and on-premises PostgreSQL data without first copying it into one store.

Identity passthrough, role-based policies, masking, row filters and audit records provide controls beyond relying on model prompts.

The walkthrough is an implementation example, not evidence of a production deployment or measured business outcomes.

Opportunities

Connect agents to governed enterprise data

Enterprise data platforms and agent deployments

Organizations with customer information spread across cloud and on-premises databases can evaluate a federated semantic layer as a way to make that data available to agents without first consolidating it. Denodo’s walkthrough provides an implementation pattern using AgentCore, an MCP Server, identity passthrough and centrally applied access policies. This creates a practical opportunity for enterprise data and integration teams to assess agent use cases against existing permissions and business definitions. The example does not establish production results or a specific commercial return; deployments would need to validate data access, response handling and operational requirements. Denodo is described as available through managed Agora or self-managed EC2 and EKS options.

Governed agent access to distributed customer data
Problem: Customer profile, order and rewards data may reside in separate cloud and on-premises systems, while agents need consistent business definitions and controlled access.
Solution: Use Denodo to federate queries through a semantic layer, pass authenticated user identity to the data layer, and apply roles, masking and row-level filters.
Target Users: Enterprise data teams, agent developers, and security and compliance teams.
Business Value: Test agent use cases against distributed data without first copying all source information into one store, while retaining centrally defined query logic and access policies.
Revenue Potential: The article identifies managed and self-managed deployment options but gives no revenue estimates or evidence of customer adoption.

Reference link

https://aws.amazon.com/blogs/machine-learning/build-a-semantic-layer-for-agentic-ai-on-aws-with-denodo-and-amazon-bedrock-agentcore

Image Source Link

https://image.slidesharecdn.com/denodoawswebinarjun21v2-cfinal-230628045934-19ff788a/75/Data-Driven-Advanced-Analytics-using-Denodo-Platform-on-AWS-9-2048.jpg

Community Discussion (0)

No discussions yet. Be the first to start the conversation!