Update
The first BigQuery write tool — a dedicated, approval-gated path
TL;DR
Reading BigQuery is unchanged. This is about the write path, which is new, separate and deliberately narrow: a dedicated tool with every protection a write is supposed to carry, while the ordinary query tool continues to refuse anything that modifies data.
What shipped
- A dedicated write tool carrying the same protections as every other write — the approval gate, the write budget, the audit row and cache invalidation.
- The general query tool still refuses to write. Running a `DELETE` or `UPDATE` through the ordinary analytics query path is blocked, and stays blocked.
- Reads are untouched and remain available to every organization with a BigQuery connection.
Worth being explicit: the ordinary query tool is registered as a read, which means a write slipping through it would carry no approval, no budget and no audit trail. That path is fail-closed by design rather than by configuration.
Why a separate tool rather than allowing writes in queries
The tempting shortcut is to let the existing query tool run whatever SQL it's given. That was tried and rejected: the query tool is registered as read-only, so a statement that modified data would have run with none of the safeguards a write is supposed to carry. A write needs to be a write in the type system, not a read that happens to mutate.
Frequently asked questions
- Can the agent run DELETE or UPDATE in a normal BigQuery query?
- No. The analytics query tool classifies any DML or DDL statement as a write and refuses it, asking for a SELECT instead. That refusal is not configurable from the agent surface.
- Does connecting BigQuery change anything about reads?
- No — reading BigQuery is unchanged. The write tool is a separate, additional capability, and a connection used only for analysis behaves exactly as before.
- What protections does a BigQuery write carry?
- The same as any other write: it pauses for your approval, draws on the write budget, records an audit row, and invalidates cached reads that the write would have made stale.