Dimensions, metrics, aggregation, chart, persistent filters, interactions and DatasetVersion bindings belong to an immutable ReportVersion. Runtime filters create a new run context rather than silently changing that saved definition.
Controlled analytics
Pin the data contract. Govern the execution. Explain the result.
Controlled Analytics binds a report to exact DatasetVersions, validates Query Context on the server and retains the permission, RLS, filter, binding and artifact context behind a supported result.
Browser Query Context references authorized columns and metrics. The backend validates it and compiles read-only SQL. Runtime filters cannot impersonate protected RLS origin metadata.
Bar, horizontal bar, line, area, scatter with optional size, pie, donut, table, KPI and multi-series charts use one versioned renderer-neutral contract. Top N with deterministic Other, temporal grain, comparison, drill, reference lines and accessible fallback remain part of that same specification.
AnalyticsRun records version bindings, status, filters, permission and RLS scope, row count, diagnostics and artifacts. Multi-binding executes saved bindings sequentially and exposes per-binding partial success, while overlay, union and merge behavior remains an explicit report configuration rather than an inferred join.
Dashboard and widget runs retain their connection to underlying report and AnalyticsRun identities. One failed widget does not need to hide successful widgets or become a false complete success.
Result samples, profiles, chart payloads, bounded full results and diagnostics retain SHA-256, size, retention and lineage metadata. Local or S3 reads are bounded and integrity-checked; public locators remain opaque. Cache identity includes report and Dataset versions, permission/RLS scope, chart/config contracts, execution policy, limits and hashed SQL parameters.
ReportVersion captures analytical intent.
Dimensions, metrics, aggregation, chart, persistent filters, interactions and DatasetVersion bindings belong to an immutable ReportVersion. Runtime filters create a new run context rather than silently changing that saved definition.
The server owns compilation and RLS.
Browser Query Context references authorized columns and metrics. The backend validates it and compiles read-only SQL. Runtime filters cannot impersonate protected RLS origin metadata.
Visualization shares one contract.
Bar, horizontal bar, line, area, scatter with optional size, pie, donut, table, KPI and multi-series charts use one versioned renderer-neutral contract. Top N with deterministic Other, temporal grain, comparison, drill, reference lines and accessible fallback remain part of that same specification.
Typed runtime filters derive valid operators and placeholders from the selected column contract.
Inspect Data supports bounded paging, sorting and column projection without redefining the saved report.
Bounded CSV, JSON and image exports retain truncation and lineage metadata.
Auto-refresh creates new run context; it does not mutate the immutable ReportVersion.
Runs preserve partial outcomes.
AnalyticsRun records version bindings, status, filters, permission and RLS scope, row count, diagnostics and artifacts. Multi-binding executes saved bindings sequentially and exposes per-binding partial success, while overlay, union and merge behavior remains an explicit report configuration rather than an inferred join.
Durable execution uses idempotency, bounded retries, timeouts, cancellation, leases and stale-run reclamation.
Run events support live replay with polling fallback when streaming is unavailable.
A failed binding retains its own safe diagnostic; a successful binding does not convert the run into a false complete success.
Artifacts and cache preserve governance identity.
Result samples, profiles, chart payloads, bounded full results and diagnostics retain SHA-256, size, retention and lineage metadata. Local or S3 reads are bounded and integrity-checked; public locators remain opaque. Cache identity includes report and Dataset versions, permission/RLS scope, chart/config contracts, execution policy, limits and hashed SQL parameters.
Current compilation scope remains explicit.
The governed Dataset-aware compiler currently targets PostgreSQL. Other source families need an accepted materialization or dialect adapter; connector presence alone does not provide that path.
Next step
Start with the flow that cannot afford ambiguity.
Bring the systems, owners, rules, delivery obligations and evidence requirements that matter.
Discuss a critical flow