A question enters on the left. The agent writes SQL, the backend validates it and runs it under a read only role, and the only schema it can read is semantic. The ELT pipeline feeds the same database from the right, so new data reaches the agent without anyone touching it.