BigQuery

BigQuery was the first service wired through enoki’s per-user path, so it exercises every guardrail: reads run under your identity, the one query entry point is read-only and cost-capped, and dataset changes are approval-gated.

Reads

• list_bigquery_datasets(project_id) — the datasets you can see in a project.
• describe_bigquery_schema(table_id, project_id) — columns and types for a table, so the model can write a correct query before running one.
• estimate_bigquery_cost(sql, project_id) — a dry run: how many GB a SELECT would scan and the rough dollar cost, without reading or billing a single byte. The safe way to size a query before you run it.
• list_bigquery_jobs(project_id, all_users=False, limit=10) — recent query and load jobs with who ran them, their state, and bytes scanned — a quick “what’s been running, and what was expensive?”
• run_bigquery_select(sql, project_id, max_gb_scanned=5.0, row_limit=50) — run a single read-only SELECT. The SQL is parsed (not regexed) and rejected unless it is one SELECT; a dry run estimates bytes scanned and refuses anything over the ceiling; the real job caps billed bytes at the same ceiling and returns at most row_limit rows.
• export_bigquery_query(sql, project_id, fmt="csv", max_gb_scanned=5.0, max_rows=10000) — the same guarded SELECT, delivered back as a Slack file (csv by default) instead of inline rows.

Writes — approval-gated

• create_bigquery_dataset(dataset_id, project_id, location="US") — write. Creates a dataset; handles the already-exists case.
• delete_bigquery_dataset(dataset_id, project_id, delete_contents=False) — write. Deletes a dataset. With delete_contents=False, a non-empty dataset fails rather than taking its tables with it.

The SELECT guard

The model generates SQL, but only a bounded read ever reaches BigQuery. Anything that parses as INSERT, UPDATE, DELETE, MERGE, CREATE, DROP, ALTER, TRUNCATE, or a raw command is refused — so “run a query” can never become “mutate a table.” This is the one place SQL is accepted at all, and it is read-only by construction. See Guardrails.

Next: Cloud Storage.