Atlas

What the agent knows

Before every conversation, Atlas gives the agent a layered system prompt. Here is exactly what is in it — and what, by design, never is.

The four layers

The prompt is assembled once when a conversation starts, in this order. Every layer below the first is explicitly subordinate to the ones above it.

  1. 1

    Platform base

    Datacoves

    Datacoves's built-in agent instructions — the authoritative foundation, rendered verbatim. Every layer below refines within it and can never override it.

  2. 2

    Organization instructions

    Your admins

    An optional set of instructions your administrators add — house rules, tone, and preferences. Framed as subordinate: they refine the agent's behavior but never relax or contradict the platform policies above.

  3. 3

    Current context

    Auto-generated

    Auto-generated facts about the workspace the conversation is in, so the agent doesn't guess. Reference only — labeled explicitly as facts, not instructions.

  4. 4

    Current user

    Auto-generated

    Auto-generated facts about the person who started the room — their roles and access, and the personal connections they've set up (with each one's tested state). Reference only, so the agent can tell them what they can do and which of their own connections are ready. No secrets.

What "Current context" includes

When your conversation is in a workspace room, the agent is told these facts about it — so it doesn't have to guess.

  • Your organization's name.
  • The conversation's active workspace and environment.
  • That workspace's environments and projects.
  • Its connections — by name, kind, provider, and credential mode, whether each has been tested, and (for a tested connection) a summary of the schemas and tables it exposes.
  • The names of your organization's other workspaces.

What it never includes

No secret ever enters the prompt. Connections appear by name, kind, provider, credential mode, tested state, and a summary of the schemas and table names they expose — but never a password, key, secret name, connection config, or any of the actual rows or data inside them. Credentials are resolved at the exact moment a tool uses them, and are never shown to the model.

What the agent can do

Inside a room the agent has a fixed set of tools. Each one runs as you — the person driving — is tenant-isolated, and fails closed if it can't tell who you are. Everything the agent can read or reach is confined to the conversation's area (and its parent areas) — never the whole workspace, and never more than the room's area allows, even when an admin is driving. Here they are, with the permission each enforces.

  • Read a knowledge page

    Read-only

    Open the full body of one knowledge page by id.

    A page outside this conversation's area, or one you cannot access, simply looks not-found — never disclosed.

  • Propose a definition

    Proposes for review

    Draft a new definition of record for a human to review.

    Requires the "propose definitions" permission in the workspace. Never publishes — it opens a review.

  • Propose an edit to a page

    Proposes for review

    Suggest a change to an existing page's body.

    Only pages within this conversation's area, and only with write access to the page. Staged for review — never applied directly.

  • Log a decision

    Proposes for review

    Capture a cross-cutting decision as a note for review.

    Requires the "propose definitions" permission in the workspace.

  • Build an answer card

    Writes in this room

    Create or update a chart or table answer card in the conversation.

    Scoped to this room; you must be a participant.

  • Create a task

    Proposes for review

    Turn the conversation into a durable task for a human to pick up.

    Requires the task-create permission in the workspace.

  • Propose an org structure

    Admins only

    Draft a starter tree of areas and connection scaffolds for setup.

    Only admins can propose. It creates nothing — an admin must press Apply, which is re-checked then.

When a warehouse connection is available, the agent also gets read-only tools to inspect and query your data (list schemas and tables, sample rows, profile columns). Only connections belonging to this conversation's area and its parent areas are available — a connection in another area is never reachable from this room. Those use the room's shared credentials, or your own if you switch to your access — never anyone else's. Administrators can also connect external tools (MCP); when present, the agent may use them under the same deny-by-default network policy.

Scope & limits

  • It describes the conversation's active workspace only — other workspaces appear by name, not their contents.
  • It lists project areas by name, not the full area tree.
  • It is assembled once when a conversation run starts — not refreshed mid-conversation.
  • Outside a workspace room, there is no context layer at all.
  • The workspace facts are not filtered by your individual permissions — they describe the workspace every participant in the room already reaches.
  • The "Current user" layer describes the person who started the room — their access and personal connections — not every participant's.