BigQuery and agents: what can a record establish?
A team needs to know which questions its records can answer. Design agent investigations around limited access, synthetic data and explicit evidence gaps.
Читать на португальскомBy Pentesty
The announcement changes the audit question
On November 13, 2026, Google Cloud described content-free conversation metrics and optional logging in customer-owned BigQuery. In the 1P solution, RLS, policy tags or masking can prevent logging for a turn without stopping the conversation. Custom agents can log different content. This is the vendor’s description, not a Pentesty observation of a deployed environment.
For a business, the decision is which evidence should accompany each consequential action. An availability metric, a conversation copy and confirmation of an operation at its destination answer different questions. Write those questions before choosing the report that will be presented to management. Assign an owner who can explain each answer.
Map the path of an action
Choose a small business task, such as looking up a synthetic order. Record the request identifier, authorized agent, account used at the destination service and expected outcome. Ask the application owner to explain how those references can be connected without copying the complete order into every system involved in the task.
Acceptance needs to reach the action’s destination. For a query, check the object accessed and the permission decision. For a change, compare the previous and subsequent state of a test resource. The analysis of agent credentials and actions develops this review of the identity used for the operation.
Test absence as carefully as presence
Build a matrix covering ordinary synthetic content, restricted content and an attempt outside the authorized scope. For each scenario, declare which records should exist, which should contain no text and who may inspect the result. Use recognizable artificial markers; do not introduce real secrets simply to demonstrate that collection works.
Repeat the check with the collection path unavailable in a controlled environment. Observe the task’s behavior and how the failure is reported. The report should distinguish execution without recorded content from a request that never reached the service. If that distinction cannot be demonstrated, document the limitation in the acceptance decision.
Give investigators the access they need
Propose separate roles for monitoring performance, investigating content and administering collection. Run the same queries under each role and retain the allowed and denied results. Include export, copying and derived views in the authorized review. Approval should describe the purpose of access, the accountable person and when the decision will be reviewed.
Agree on retention with the teams that would respond to an incident. Test the expiry of a synthetic record and locate the copies expected in the design. Document how collection could be interrupted during an exposure investigation. Do not let a retention period chosen for a dashboard substitute for a decision about stored content.
Deliver a conclusion others can reproduce
Keep the scenario matrix, evaluated configuration, timestamps and test identifiers. Add the agent version and dependencies involved in the task. Every conclusion should point to a reproducible observation. Where an outcome depends on an assumption, name that assumption and assign someone to validate it before the assessment is accepted.
Review the evidence when the agent, destination or access policy changes. For tasks that also handle files, consult the discussion of session mounts and permissions. A management handover can remain concise: an investigable question, available evidence, a known gap and the owner of the next check.
Frequently asked questions
How can testing begin without real documents?
Choose a small task and use synthetic markers. Define the expected result, authorized identity and references needed to connect execution to the destination service.
Who should be able to inspect content?
Define roles by purpose and test what each can read, copy and export. Record who approves access and a date for reviewing that decision.
How should an evidence gap be documented?
State the scenario, interval, configuration and unanswered question. Assign someone to decide whether further investigation or acceptance of the limitation is appropriate.
When should the assessment be repeated?
Repeat the scenarios after changes to the agent, integrations or access rules. Preserve earlier evidence so that observed behavior can be compared across versions.
Sources and references
Original Pentesty analysis, published November 13, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.