What's new in Colrows.

Document Intelligence is generally available

Colrows now answers questions from your documents with the same governance and discipline it applies to SQL. Connect a document source, ask in plain language, and get answers quoted from the source text with citations — or a clear abstention when the documents do not support one.

• Connect documents from AWS S3, Google Drive, or Microsoft OneDrive, or upload PDF, DOCX, Markdown, and text files directly. Sources are read-only.
• Hybrid dense and sparse retrieval with reranking, so answers draw on the passages that actually match — by meaning and by exact terms.
• Cited, verified answers with Answered, Partial, Abstained, and Unavailable statuses. Colrows abstains rather than guesses when the evidence is not there.
• Complete queries scan up to 1,000 documents and return Match, No match, Ambiguous, or Unreadable per document.
• Permission-aware by default: collections carry readers and managers, and per-user access maps to S3 object tags, Google Drive sharing, or Microsoft Entra identities. Access fails closed, and stale permissions block rather than leak.
• Turn it on from Administration → Settings → General → Enable Document Processing.

Heads-up: document questions are asked in the document workspace today. Answering documents from AI Analyst chat, the MCP tools, and mixed SQL-plus-document answers are on the roadmap.

Attribute-based access control, data masking & Microsoft SSO

Governance gets a new policy engine. Access rules can now depend on user and resource attributes, and redaction is rebuilt as data masking. Sign-in adds Microsoft accounts and a safer password reset, and agents can search the semantic layer directly.

• Attribute-based access control: define user and resource attributes, sync them from your identity provider, and use them in access rule conditions.
• Data Access Policies rebuilt around subjects and rules, with allow and deny effects. Default is deny, and deny wins.
• Data Masking Policies replace redaction policies, with full, keep-first-N and keep-last-N masking and pattern-based rules.
• Access and masking policies can be managed over the API with OAuth client credentials, and a new semantic:read-write scope covers semantic layer writes.
• Microsoft sign-in for work, school and personal accounts, a reworked password reset flow, and fixes for account-takeover risks such as email pre-registration.
• Delegated authentication for embedded AI Assistants.
• Semantic search, SQL resolution search and a batch entity lookup are available to agents over MCP and REST. Answers now cite the versioned verified queries and definitions they used.
• Datasources gain a database update plan, and stored credentials are hardened with SSH secrets preserved.
• Better generated descriptions and category sets, one paginated verified query catalog, and health endpoints for monitoring.

Heads-up: this release is breaking for governance. Recreate existing access and redaction policies in the new Data Access and Data Masking formats; redaction routes move from /api/redaction to /api/masking. Policies apply only on datasources with Restricted Access turned on. Semantic modifiers and entity auto-generate are removed, and new client tokens should request semantic:read-write instead of semantic:write.

Semantic datasets, composable metrics & analytics-platform ingestion

The semantic model gains semantic datasets, composable and SQL-based metrics with grain, and semantic personas. Metadata discovery and the AI Assistant reach more platforms, and pipelines become repairable and safely queued.

• Semantic datasets (authored SQL, source linkage, publishing, validation) and composable, SQL-based metrics.
• Analytics-platform ingestion: Apache Superset, Power BI, and Unity Catalog, plus Dremio query history.
• Reusable embedded AI Assistant with organization-aware context and token tracking.
• Full and incremental pipelines with queueing, repairable projections, and a new DEGRADED state for partial failures.

Heads-up: the new DEGRADED pipeline state and remodeled metric/persona fields are breaking; test Superset, Power BI, or Unity Catalog connections before scanning.

Governed agent access, documents & unified analytics

Colrows MCP ships as the supported surface for agent access to the semantic layer, alongside a durable document-processing pipeline and a unified AI Analyst cache for repeat queries.

• Colrows MCP server: REST endpoints, OAuth discovery, tool-call continuation, and governed metadata and data access.
• Document upload and a durable processing pipeline on S3.
• Unified AI Analyst data cache with configurable eviction and refresh.
• analyze_data renamed to ask_data; Workspace merged into the SQL Editor.

Heads-up: MCP replaces the retired CLI clients; update callers of analyze_data and regenerate join-discovery clients. The organization CLI no longer creates a database automatically.

Semantic platform re-architecture

The semantic core was rebuilt for durability and scale, with a single MongoDB Atlas vector store and a durable consensus control plane governing how meaning is generated and versioned.

• One MongoDB-backed vector collection spanning actions, events, entities, and categories.
• Signal → Claim → Proposal → Asset workflow bounded by immutable semantic scopes.
• Durable consensus service with source scanners for profiles, query history, catalog metadata, and joins.
• New catalog connection framework; MindsDB, Dremio, and Databricks onboarding.

Heads-up: unscoped legacy runs are rebuilt, Business Term Anchor becomes TableHint, and bundled MySQL and Snowflake drivers must now be supplied explicitly.

Multi-vector embeddings & expanded dialect support

Concept lookup moves to multi-vector embeddings per entity (definition, usage, combined), and dialect compilation extends to ClickHouse and Trino.

• Up to 3× faster compile-time policy evaluation on graphs with 10K+ entities.
• Join-path-proof edge cases resolved across 4+ datasets with ambiguous cardinality.

Compile-time governance, GA

RBAC and ABAC policies are materialized into the execution plan at compile time. A persona's allowed subgraph is resolved before any SQL is generated, so unauthorized queries fail compilation instead of running.

• Row and column-level predicates compiled per persona.
• Point-in-time reproducible audit log for any historical query.
• Query-explosion guards: ambiguous joins fail compilation with clear errors.

Conversational AI Analyst

Natural-language questions compile through the semantic graph into deterministic, governed SQL, and every answer ships with its reasoning chain rather than a probabilistic guess. Slack integration included.

• Stateful conversational scope: follow-ups resolve against the same graph version and policy context.

Semantic Studio

A visual editor brings definitions, relationships, and governance rules into one plane, with multi-scope inheritance from global to datastore to persona to user.

• Autonomous drift detection and conflict resolution across thousands of entities.
• Versioned graph with structural diffing for rollback and point-in-time reproducibility.

16+ data sources & dialect-perfect SQL

Support for Snowflake, Databricks, BigQuery, Redshift, Postgres, MySQL, and 10+ more, with dialect-perfect SQL per engine and no data movement.

• Inline visualization and query-plan introspection before execution.

Colrows Semantic Execution Layer - GA

The runtime launches with four isolated stages (intent parsing, semantic resolution, constrained planning, governed execution) over a typed, multi-scope, versioned knowledge graph. The first AI Data Analyst Agent compiles natural-language questions into deterministic, auditable SQL.