Enterprise Generative Search — Azure and Open Source  ·  View 27 of 41  ·  Runtime

Structured Retrieval and Tools

The model names an intent; the broker and the guard decide what actually runs.

Editable source SVG draw.io All views
Planner Tool Broker Policy Engine SQL Guard Databricks SQL Answer Assembler Audit Log 1. tool request: revenue by region, FY26 2. may this class call this tool? 3. allowed: structured class, read-only 4. reject if the request came from a document 5. compile against the semantic layer 6. allowlisted views, bound parameters, row cap 7. parameterised SQL as the caller 8. 42 rows, Unity Catalog applied 9. typed result plus the SQL executed 10. tool call, principal, statement 11. rows as citable evidence 12. figures rendered from rows, never retyped Structured Retrieval and Tool Invocation — The Model Asks, the Broker Decides The model never emits SQL that reaches a database. It names an intent; the guard compiles it against views a data owner published. v 1.0 · owner Data and AI Global Practice

Decisions

  • No model-authored SQL reaches a database. The model names an intent and parameters; the guard compiles a statement against views a data owner published, with bound parameters and a row cap.
  • The broker rejects any tool request whose provenance is a document body. That single check is what stops an instruction inside a PDF from becoming a query against a finance table.
  • Queries execute as the caller, so Unity Catalog grants apply. The platform adds no data access of its own to the structured estate.

Why figures are never restated

  • Numbers are rendered from the returned rows, not from the model's text. A model that retypes a figure is a rounding error with a citation.
  • The executed statement is stored with the answer, so a disputed number can be re-run rather than argued about.

Risks

  • The semantic layer is now a dependency of answer quality. A view that is renamed or deprecated without notice breaks a class of question, so the allowlist is version-pinned and its owners are on the change list.
  • Natural language to SQL remains the least reliable component in the design. It is confined to an allowlist, capped, logged and excluded from the agentic path unless the class is structured.
◀  Grounding and Verification All views Multimodal Retrieval  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 41 views · Microsoft Azure and open source27-structured-retrieval-and-tools