The Agentic AI Pyramid — Part 2 — Tools

Quick recap. Agentic analytics has five layers: Data → Meaning → Access → Thinking → Action. Each layer needs the one below it. The AI model itself sits only on Layer 4.

This part goes layer by layer. For each one: what it does, a marketing example, what you can buy, what you can get for free, and what usually goes wrong.

Layer 1 — Data

Where is your data kept?

What it does: keeps all your data in one place, in tables an agent can read.

For a marketing team: your GA4 (Google Analytics 4) events, Google Ads costs, CRM (Customer Relationship Management) deals and offline orders all sit in one place — not five exports that never match. Ask how much you spent last month and there is one answer.

What changed: the AI moved into the warehouse. You no longer send data to a model — you run the model where the data already sits. Snowflake calls this Cortex AISQL: you call an AI function inside a normal SQL (Structured Query Language) query. Google puts Gemini inside BigQuery. Microsoft does the same in Fabric.

The warehouse did not appear. It became AI-ready.

This is not only convenient. It means customer data never leaves your private cloud to reach a model. For a bank or an insurer in the EU, that is usually the entire conversation.

What goes wrong: usually nothing. Most companies have already solved this layer. If you have a warehouse, move on.

Layer 2 — Meaning

What do your numbers mean?

This layer decides whether your project works.

What it does: explains your business to the agent. What "active customer" means. Which of the six revenue columns is the real one. Which table is old.

For a marketing team: a manager asks about return on ad spend (ROAS): "How was our ROAS last month?"

Without this layer the agent must guess. It finds four tables with a revenue column, picks one, and gives you a number. The number looks fine. It is wrong by 30%.

With this layer the agent knows ROAS is defined in one place — revenue after refunds, divided by ad cost — and gives the answer your analyst would give.

This layer has three parts

People mix these three up constantly. They do different jobs.

1. The semantic model — your numbers. Your business rules, written once. What counts as revenue. How ROAS is calculated. Who may see which rows.

It is a set of rules, not a copy of the data. The agent reads the rules and builds correct SQL from them. If you already have a Looker LookML model or a dbt project, you have this. You may only need to mark which parts an agent is allowed to trust.

2. Vector search and RAG (Retrieval-Augmented Generation) — your words. Your business is not only numbers. It is also documents: tracking notes, campaign naming rules, the wiki page explaining why a channel was renamed in March.

A vector database stores text as numbers, so you search by meaning instead of exact words. Somebody asking about "churn" also finds the document that says "cancelled subscriptions".

RAG means Retrieval-Augmented Generation. It sounds complicated; it is not. Before answering, the agent searches your documents, takes the useful parts, and puts them in front of the model. The answer then comes from your material, not from what the model happened to memorise on the internet.

A simple rule I use: numbers come from the semantic model, words come from RAG. Use RAG for numbers and you get confident wrong maths. Use the semantic model for policy questions and you get nothing.

3. The catalog — your rules. Which table is trusted, which is old, where the data came from, who owns it. This is what stops an agent using the abandoned table somebody built in 2023.

New in 2026: every major vendor now ships a semantic layer built for agents, not for dashboards. Snowflake added Semantic Views and then Cortex Sense, which reads your query history and metadata to build context automatically. Microsoft shipped Fabric IQ, which connects data to business entities and rules. Google grounds its agents in the LookML model you may already have.

The direction is the same everywhere: write your business logic down once, in one governed place, and let every agent read it.

What goes wrong: almost everything. This is where projects die. Teams buy an AI product, point it at a messy warehouse, get plausible nonsense, and blame the model.

The second most common mistake is building only part two — loading every company document into a vector database, calling it done, and then wondering why ROAS is still wrong. Nobody built part one.

If you fix one layer this year, fix this one.

Layer 3 — Access

How does the agent read your data?

What it does: gives the agent a key. Without it, the agent can only talk. With it, the agent can look things up.

For a marketing team: you write in the chat, in your own words:

"Which campaigns spent more than €1,000 last week and brought no orders?"

A minute later you have the list. Not a guess — the agent went into your reporting system, looked, and came back. It shows where the numbers came from, so your analyst can check.

Before this layer existed, an AI could write a very convincing paragraph about your campaigns without ever opening your data.

The key is usually MCP — the Model Context Protocol, the open standard for plugging an agent into a data source.

New in 2026: MCP won.

Anthropic released the Model Context Protocol as an open standard in November 2024. Anthropic invented it, but it is not an Anthropic product — it is a standard, and by 2026 every major vendor shipped its own server for it.

That is the important point, and it is easy to miss: MCP is not a row in the Anthropic column. It runs across all of them. Google has a fully managed BigQuery MCP server and the MCP Toolbox for Databases. Snowflake's managed MCP server went generally available in November 2025. Microsoft ships the Azure MCP Server and a Fabric MCP server. OpenAI supports MCP in the Responses API and the Agents SDK.

Rival vendors rarely agree on anything, so this is worth noticing. The practical effect: before MCP, connecting an AI to five data sources was five integration projects. Now it is closer to five config files — and you can move between vendors without rewriting the connections.

A correction worth making. My first draft put Claude Code and Cortex Code on this layer. A reader asked me why, and he was right to. Those are not access tools — they are complete agents. Each one already contains a model, a connection to your systems, and a loop that keeps working. They are vertical bundles, like the agents described in Part 1, not a piece of Layer 3.

Layer 3 is the connection itself: the protocol, the query engine, the code sandbox. If a product contains its own brain, it is not an access tool.

What goes wrong: permissions. It is very easy to give an agent more access than the person asking the question has. Set permissions at Layers 1 and 2 and let the agent inherit them. Part 3 goes into this properly, because this is the layer with the sharpest risks.

Layer 4 — Thinking

Who finds the answer?

What it does: breaks a big question into small steps, checks each one, and fixes mistakes.

For a marketing team. A CMO (Chief Marketing Officer) asks: "Why did our cost per order go up in July?"

That is not one question. It is a small project:

1. Did we get less traffic?
2. Did the channel mix change — more expensive channels, fewer cheap ones?
3. Did people buy cheaper items?
4. Did the tracking break? (In my experience this is the answer more often than anyone admits.)

Then one more step reads all four results and writes you a paragraph. Not four dashboards.

Two parts — the brain and the manager

This is what used to hide inside the words "reasoning and orchestration", and separating them clears up most of the confusion.

The model — the brain. It reads the question, decides what to do, and writes the answer. Claude Opus, the GPT-5 series, Gemini. This is the LLM, and it lives here and nowhere else in the pyramid.

The framework — the manager. The code that runs several agents, passes work between them, retries failures and keeps track of state. It does no reasoning of its own — it is a project manager, not a thinker. Claude Agent SDK, OpenAI Agents SDK, Google's Agent Development Kit (ADK), Microsoft Foundry and Copilot Studio, Snowflake Cortex Agents. An SDK is a software development kit: ready-made code you build on top of.

A useful test: if you swap it out and the answers get better or worse, it was the model. If you swap it out and the answers stay roughly the same, it was the framework.

So, to answer a question I get often: the Google equivalent of Claude Opus is Gemini, not ADK. ADK is a framework, and its equivalents are the Claude Agent SDK and the OpenAI Agents SDK.

One more useful fact: most frameworks are model-agnostic. Google's ADK is tuned for Gemini but runs other models. The Claude Agent SDK is Claude-first but also runs on AWS Bedrock, Vertex AI and Azure. You are not forced to take the brain and the manager from the same supplier.

Also worth knowing if you are building: OpenAI is winding down its visual Agent Builder canvas and pointing developers to the code-first Agents SDK. If you built something on the drag-and-drop canvas, check the migration path.

What goes wrong: people start here. They pick a framework before they have a dictionary, then spend three months writing prompts to work around bad data.

Layer 5 — Action

How do you get the answer?

What it does: brings the answer to a person, instead of waiting for a person to go looking.

For a marketing team: nobody opens a dashboard. At 08:00 you get a message:

"Paid search cost per order rose 22% yesterday. Almost all of it is one campaign. That campaign's bidding was changed on Monday."

You did not ask for it. That is the point. And then you decide whether to change the bidding back.

New in 2026: this layer stopped being a demo. Google's conversational analytics is generally available in BigQuery and Looker, and its scheduled agentic workflows — an agent that runs anomaly detection on a timer and writes a report into a chat thread — are in preview. Anthropic put Claude inside Excel, which is where most business users actually work. Not in your BI tool. In Excel.

What goes wrong: too many alerts. An agent that sends 40 a day gets muted in a week. Start with one. Make it good.

Who covers which layer

Two honest observations.

Google, Snowflake and Microsoft are strong at the bottom because they own your data. Anthropic and OpenAI are strong in the middle and top because they own the thinking. That is why almost every real stack I see is a mix — Snowflake Intelligence running on Claude, or a Gemini agent grounded in a Looker model.

You are not choosing one vendor. You are choosing where each layer comes from.

Old way vs new way

One thing to be clear about: none of this is new because warehouses are new. Data warehouses and data lakes have been around for decades. What changed is who they were built for. They were designed for dashboards and human analysts, so data was exported out to be processed elsewhere. Now the same warehouse has to serve an agent as well.

Notice the last box in that image. A person stays in the loop on every layer. You define what ROAS means, you decide who sees which rows, and you approve the fix before the budget moves.

This does not remove analysts. It removes typing. The questions get harder, not easier. Somebody still has to know that the July spike was a tracking bug and not a market change. An agent has never watched a tag deployment go wrong on a Friday afternoon.

Open source: is it free, and is it safe?

Every layer above has a free option. But if you open the pricing page for Metabase, Superset hosting or Grafana, you will find prices. So a fair question is: are these really open source?

Yes — and an open-source tool can still have a price list. Those are not contradictions. There are three different things people call "open source", and the difference matters when you are choosing what to build on.

1. Fully open

Community or foundation projects under permissive licences. Nobody holds features back behind a paywall. Apache Superset (Apache 2.0), Apache Iceberg, PostgreSQL, DuckDB, pgvector, Trino, Jupyter, Streamlit, and the MCP spec and SDKs.

You still pay — for servers, for upgrades, and for the person who owns it. But you pay nobody for the software, and no feature is locked.

If you found a price for one of these, you found somebody hosting it for you, not the project charging you.

2. Open core

A real open-source core you can self-host, plus a commercial tier from the company that builds it. This is the model behind most of the tools in this article:

• Metabase — the open-source edition is AGPLv3 and free to self-host. Pro and Enterprise are paid.
• Grafana — Grafana OSS is AGPLv3 (relicensed from Apache 2.0 in 2021). Grafana Enterprise and Grafana Cloud are paid.
• Cube Core — Apache 2.0. Cube Cloud is the commercial platform on top.
• dbt Core — Apache 2.0. dbt Cloud is paid, and the dbt Fusion engine is proprietary under dbt's own licensing agreement.
• ClickHouse, Qdrant, Weaviate, Chroma, OpenMetadata, DataHub, LangGraph, CrewAI — open-source core, managed cloud or enterprise tier alongside.

The pricing page you found is that commercial tier. The free edition still exists and is genuinely open source.

But read what is in each tier. This is the practical trap, and it matters more here than in most software decisions:

Metabase puts row-level permissions, audit logs and advanced caching in the paid tier.

Row-level permissions are exactly what Layer 2 needs to stop an agent showing somebody data they are not allowed to see. So "we will use the free edition" can quietly become "we have no row-level security", which is a Layer 2 problem wearing a budget disguise. Free and safe-by-default are two separate decisions.

3. Open weights — not open source

With most open models you get the weights and permission to run them, under the vendor's own licence rather than an open-source one.

• Genuinely open: Qwen3 (Apache 2.0), DeepSeek R1 (MIT), gpt-oss (Apache 2.0).
• Open weights with conditions: Llama 4 (Llama Community Licence, with usage caps and country restrictions), Gemma (Gemma Terms of Use).

Either way you get enough to self-host. You do not get the training data, so you cannot fully audit what the model learned.

So what does open source actually cost?

The software is free. Running it is not. A self-hosted stack needs servers, monitoring, upgrades and a person who owns it, and a large open model needs serious GPUs. The cost moves from a licence line to an infrastructure line and a headcount line.

For a small marketing team, a managed product is usually cheaper in total. For a large company that already runs its own infrastructure, open source can be much cheaper — and at Layer 4 it is sometimes the only option your legal team will accept, because the data never leaves your network.

My position: open source is a serious option at Layers 1, 2 and 5 for most teams today. At Layer 4 it depends entirely on your GPUs and your people. At Layer 3, use the open standard but be careful whose servers you install.

One caution on all of this: licences change. Grafana moved from Apache 2.0 to AGPLv3 in 2021. dbt reorganised its licensing in 2026. I checked everything above in August 2026 — confirm on the project's own page before you build on it.

And a proper head-to-head test — open-source stack versus paid stack, same questions, measuring accuracy, total cost and effort — is the investigation I want to run next.

Sources

Google Cloud — BigQuery MCP server · Managed MCP servers for Google Cloud databases · Conversational Analytics, Q3 2026 · Conversational Analytics in BigQuery now GA · Gemini in BigQuery

Snowflake — Cortex Sense and the context layer · Snowflake-managed MCP server · Summit 2026 recap

Microsoft — Build 2026: Fabric IQ, Foundry, OneLake · Azure MCP Server · Microsoft's official MCP server catalog

Anthropic and OpenAI — Introducing the Model Context Protocol · OpenAI AgentKit deprecation · Claude Agent SDK vs OpenAI Agents SDK vs Google ADK

Open source and licences — Grafana licensing (AGPLv3 since 2021) · dbt licensing FAQ · Cube Core is Apache 2.0 · Superset vs Metabase vs Redash: licences compared · Open-source LLMs in 2026: benchmarks and licences

Next: Part 3 — Privacy, security and the human in the loop. Including the risk almost nobody plans for: how a vector database quietly becomes a data leak.

Disclaimer

Informational only; not advice. Believed accurate as of August 2026, without warranty. Vendors change names, features and licensing — check official sources before deciding. Trademarks belong to their owners.

This article reflects my personal views, not those of any employer or client.

I write about data, analytics and AI at makskulish.com. You can also find me on LinkedIn.