Governed Analytics, Certification & Embedding

Governed analytics — certified numbers everywhereDefine revenue once, certify it once, and get the same number in a chart, a cell, an alert e-mail, an AI agent's answer and a dashboard embedded in your customer portal. The semantic model (chapter 21) gives every business number one definition. This chapter is about what that definition reaches. Since release 1.6 a governed metric can be the source of a sheet chart, a pivot table or a dashboard widget; one governed value can sit in a cell through =METRIC(); a pipeline step can read metrics on a schedule; an alert can watch a metric for an anomaly, a move or a forecast crossing a line; an outside AI agent can ask for it over the Model Context Protocol; and a dashboard built on it can be embedded in your own web application, scoped to one customer. Every one of those surfaces plans its SQL from the definition — nobody types the formula of a governed number again — and every query runs with the caller's own rights: object grants, row filters and column masking. On top sits the control a regulated organisation needs: certification. A steward certifies one version of a definition; with the publish gate on, reports, agents, METRIC() and embedded dashboards get only the certified version, so an edit changes nothing for readers until it is reviewed. The same certification, with four-eyes review and a lapse on any change, applies to sheets, dashboards, reports, pipelines and queries through the content catalog, which also shows what each object is built from, what it feeds, and who actually uses it. Everything that opens the product to the outside is off until an administrator turns it on.

What it does

Governed metric as a source: in a chart, pivot or dashboard widget set Read from → Governed metric, pick Measures, Break down by and Saved filters by name, and the semantic layer writes the SQL and runs it on the metric's own connection — Snowflake, Databricks, BigQuery or the built-in DuckDB
A warning on measures that cannot be re-totalled — averages and distinct counts — before a pivot sums them into a wrong grand total
=METRIC("revenue", "region", "EMEA") puts one governed value in a cell; dimensions and members come in pairs, cell references work as values, and every METRIC call on a sheet is fetched in one batch
The Governed metrics pipeline step reads measures by dimensions with saved filters, conditions and ${param} values, and fails by default when the row limit cuts the result, so a scheduled total can never be silently short
The publish gate (ANALYTICS_SEMANTIC_PUBLISH_GATE=certified) serves every consumer the last certified version: an edited certified metric keeps serving its certified version, and a never-certified one is not served at all and says why
Every save of a semantic object keeps a version with its definition hash; Restore makes an earlier version current again as a new version — history is never rewritten — from the History panel or the API
Insight watches: an alert whose source is a statistical check on a table or a governed metric — an anomaly in the latest period, a move of at least x % against the previous period or a year earlier, or a forecast crossing a line — with low, normal or high sensitivity
Data stories: Dashboard → Share → Data story writes a few sentences about a dashboard in which every sentence cites numbered sources and every figure is checked against the facts that sentence cites; an AI explanation box does the same for one block of a PDF report, and an alert e-mail can explain itself
ATX AnalyticsTable as an MCP server at /api/v1/mcp: Claude, Copilot Studio, Cursor or your own agent can search_metrics, describe_metric, query_metrics and list_catalog — read-only, no SQL, with the caller's rights
Embedded analytics: a dashboard in an iframe in your own application, opened by a short-lived signed token your backend mints, from exactly one allowed origin, with parameters such as tenant locked inside the token for per-customer rows
Import dbt / OSI…: dbt MetricFlow YAML or manifest.json and Apache Ossie (OSI) models become native datasets, dimensions, joins, measures and calculated members, previewed first, tagged imported:dbt or imported:osi and uncertified until a steward signs them off
Settings → Catalog & usage: every sheet, dashboard, report, pipeline, saved query, schedule, alert rule and semantic object the installation knows, with what it is built from, what it feeds, and how far a change would reach
Content certification with a four-eyes workflow — Ask for certification, Certify, Reject, Deprecate, Withdraw — recorded against the object's definition, so any edit shows Changed since certified until it is reviewed again
A usage report for administrators and content stewards: views per day, most viewed objects, people, exports, and the projects, sheets, dashboards and reports nobody opened
Ask Greg builds on certified metrics first, with a Certified, Governed or Unverified badge under every answer worked out from the tools that actually ran; its quality is evidenced by a live 44-case capability matrix you can run against your own model

How it works

A revenue-by-region chart from a governed metric: insert any chart, set Read from → Governed metric, Measures → revenue, Break down by → region, Saved filters → completed_orders. The line under the fields says where it runs — "Runs on Snowflake — Sales DW" — and a Certified badge sits beside every certified measure. The chart's numbers match every other report that uses revenue.
A regional table in a sheet: type EMEA, AMER, APAC and LATAM down a column, put =METRIC("revenue", "region", C1R2) beside the first and copy it down; the four values are fetched in one round trip. =METRIC("revenue") / METRIC("orders") computes an average order value in the sheet from two governed numbers.
Changing a certified metric with the gate on: an analyst edits revenue to exclude refunds; the object turns Lapsed and reports keep getting the certified version. The analyst presses Request certification, a steward compares the definition with its history and presses Certify — the requester cannot certify their own request — and from that moment every consumer gets the new version, with nothing republished by hand. A bad change is undone with Restore.
An insight watch: Transform → Pipeline → Alerts → New alert → Source: An insight watch. "Revenue down 10 % month over month on the warehouse" is Check for: A change vs an earlier period, Watch: A governed metric, Measure: revenue by order_date › month, Compare with: The previous period, Down, 10. The condition, subject and body are filled for you; Run now shows the result. No AI model decides whether it fires.
A data story for the board: open the dashboard and click Dashboard → Share → Data story. Every chart over time, KPI and metric widget becomes a subject; set Written for and an optional direction, then Write the story. The figures come from period comparison, anomaly detection, key drivers and forecasting computed locally; the model only words them, and a sentence with a figure its cited facts do not support is removed or marked. With no model configured the story is written from templates, so a scheduled PDF never prints an empty box.
An outside agent: an administrator sets ANALYTICS_MCP_SERVER=1, issues a scoped service token with the viewer role, and adds the endpoint to the agent — for Claude Code, claude mcp add --transport http atx https://atx.example.com/api/v1/mcp with the bearer header. The agent finds metrics, reads their compatible dimensions and queries them; it never writes SQL and never sees a credential.
A customer portal: the administrator sets ANALYTICS_EMBED=1 and the exact origins in ANALYTICS_EMBED_ORIGINS. The portal's backend posts the dashboard and { "tenant": "ACME" } to /api/embed/token with its service token; the page hands the token to the frame. The tenant is inside the signed token — the page cannot change it — and a widget that needs a parameter the token does not carry shows an error instead of unscoped data. /api/embed/revoke stops every earlier token for a dashboard at once.
Certifying a board report: Settings → Catalog & usage → Catalog, find the report, read Built from and Feeds, click Ask for certification with a note. A content steward reviews and clicks Certify. If the definition changed between request and decision, the decision is refused and must be requested again, so a reviewer always approves what they saw.

Practices that keep it reliable

Build board-pack charts on governed metrics rather than tables, so a definition changed in one place changes every report at once
Turn the publish gate on before you embed a dashboard or open the MCP server: outside consumers should only ever see certified definitions
Certify imported dbt and OSI metrics deliberately — they start uncertified, and with the gate on they are not served until someone signs them off
Give the MCP server and every embedding backend its own scoped service token with the lowest role that works, and grant it only the connections it needs
Mint embed tokens on your backend, never in the browser, keep their lifetime short, and lock every row-scoping parameter in the token
Name content stewards explicitly (ANALYTICS_CONTENT_STEWARDS) and keep four-eyes on, so requesting and granting are always two people
Review the usage report's "not viewed in this period" list each quarter before certifying more content — certification is worth most on what people actually use

In a regulated environment

One security model under every surface: sheets, dashboards, METRIC(), pipelines, alerts, the MCP server and embedded views all run with the caller's own object grants, row filters and column masking, and every query is audited with its mode (sheet, metric, mcp, embed).
Certification an auditor can follow: it is recorded against the definition hash, lapses on any change, enforces four-eyes in server code rather than by hiding a button, and writes every transition to the tamper-evident audit trail (content.certification.*). Certifications are stored on the server, not in the project folder, so nobody with write access to a project can type one in; on the desktop they are marked self-certified.
Privacy-aware usage reporting: ANALYTICS_USAGE_IDENTITIES shows people by name, as stable pseudonyms, or not at all — the switch a works council or data-protection officer usually asks for — while the audit trail itself always records who.
Off until switched on: the MCP server (ANALYTICS_MCP_SERVER=1, licence component mcp-server) and embedding (ANALYTICS_EMBED=1 with exact origins, licence component embedded-analytics) each need an administrator; only the embed page may be framed, and only by the listed origins.
Traceable AI wording: data stories, AI explanation boxes and alert explanations may word a narrative but may not supply its figures; code checks every figure against the facts its sentence cites and removes what it cannot match, and every answer's badge is worked out from the tools that ran, never from the model's text.
Stated plainly: the MCP server and embedding read, they do not write; dbt and OSI are imported, not exported; and nothing tests automatically that a metric still runs against its database before it is certified.

Glossary terms on this page

ATX Institute on LinkedIn

This site needs JavaScript for the full experience. Every page above is reachable without it.