Set up the AI DBA
Create the operator key, write the policy that decides what runs by itself, and turn on AI-written fixes.
Open Cognis → Cognis Settings (/cognis/dba/settings). Only owners can change these settings. Viewers can read them.
Settings are per connection. A new connection starts paused and disabled: nothing runs until an owner turns it on.
The page has three tabs:
| Tab | Holds |
|---|---|
| AI DBA Access | The operator key, GitHub, and the dbt Cloud CI job |
| AI DBA Policy | On or off, which actions, scope, limits, blackout windows |
| AI DBA Privacy | Consent to send SQL to the AI model |
You need an operator key only for BigQuery changes. Pull-request fixes need only GitHub. See GitHub pull requests.
Operator key
The operator key is a second service account. It holds only the write permissions you pick. The scanner key stays read-only.
- It must be a different service account from the scanner. If you paste the scanner key, it is refused.
- If the scanner key can write, the page shows a warning. Remove those permissions from the scanner role.
- The operator's own BigQuery jobs never show up in your findings.
- The key is encrypted at rest, the same way as the scanner key.
Permission groups
Pick only the groups for the fixes you want:
| Group | Lets the AI DBA | Used by |
|---|---|---|
| Table options | Change table clustering and expiry | Add clustering columns, Quarantine stale table |
| Dataset options | Change dataset time travel and storage billing | Shorten time-travel window, Switch storage billing model |
| SQL validation | Dry-run SQL. Can read table data | Exact bytes for AI fixes and the query optimizer, Create materialized view |
| Materialized views | Create and drop materialized views | Create materialized view |
| Reservations | Change reservation baseline slots, on the admin project | Resize reservation |
| BI Engine | Change the BI Engine reservation size, on the project that has it | Shrink BI Engine reservation |
| Reservation assignments | Move a project between a reservation and on-demand, once or on a daily schedule. Grant it on the admin project and on each project to move | Move project to the cheaper pricing model |
| Table rewrite | Create, rename and drop tables | Rebuild table with partitions, Drop the rebuild backup |
Create the key
- In Access → Operator key, tick the groups you want.
- The page shows
gcloudcommands for exactly those groups. Run them in Cloud Shell, in order:- Create a role with only the permissions you picked.
- Create the operator service account.
- Give the role to the service account.
- Download the key file.
- Paste the key JSON, or pick Enter fields and fill in the project ID, client email and private key from the key file. The key is checked as you type. Click Save and check key.
- SlashPeak tests each permission. The status shows All groups granted, Some groups missing, or Check failed, with each missing permission.
Click Check again after you change IAM. Delete key removes it and cancels pending actions.
Policy
The policy decides what the AI DBA may do on this connection. Nothing runs by itself unless every rule allows it.
On or off
- Enabled: the AI DBA plans fixes and follows the rules below.
- Disabled: nothing is planned or run.
Actions
Each action type has a switch:
- Off: never suggested.
- On: suggested, but waits for an owner.
- Run by itself (only for actions that allow it): runs with no owner, inside the limits below.
- Open PR by itself (pull-request actions): opens the pull request with no owner. A person still merges.
Some actions always need an owner, whatever you set: switch storage billing model, quarantine stale table, rebuild table with partitions, drop the rebuild backup, create materialized view, resize reservation, shrink BI Engine reservation, move project to the cheaper pricing model.
Use Turn all on or Turn all off to set every action at once.
Scope
| Setting | Meaning |
|---|---|
| Auto-apply only in these environments | Found from the dataset name: prod, staging, qa, dev. Default: dev and staging. A dataset with no match never runs by itself |
| Only these datasets | Allow list, comma-separated. Empty = every dataset |
| Never these datasets | Deny list. Wins over the allow list |
Limits
Anything over a limit waits for an owner.
| Setting | Default |
|---|---|
| Max actions per day (1 to 100) | 5 |
| Max auto-applied savings per month ($/mo) | $1,000 |
| Ask an owner above ($/mo per action) | $500 |
| Verification window (hours) | 24 |
These are your own safety limits. A number box cannot be left empty. To stop all fixes, set the mode to Off or pause; do not use a limit of 0. Your plan's monthly AI usage and its open pull request limit apply on top. See Plan limits.
Blackout windows
Times when the AI DBA makes no writes. Pick the weekdays and the hours. Hours use your account timezone. An action that lands in a blackout waits and tries again later.
Allow AI-written fixes
Some fixes are written by an AI model (the ones marked "AI PR", and Create materialized view). They need two switches:
- Allow AI-written fixes on this connection, in the policy.
- Send SQL to the LLM, the account-wide consent on the AI DBA Privacy tab.
Without both, only the rule-based fixes run.
AI-written fixes also stop for the day when your account reaches a daily cap on AI spend. Planning resumes the next day.
Send SQL to the LLM (consent)
AI-written fixes use Claude (Anthropic's model, run on Google Cloud Vertex AI). An owner must allow it once for the account.
| Sent to Claude | Never sent |
|---|---|
| The finding | User emails (removed first) |
| The query text | Keys and tokens |
| The table schema | profiles.yml and .env files |
| The files being fixed | Table rows |
Google Cloud and Anthropic do not train on this data. The page shows who allowed it and when. Click Turn off to stop. If the consent text changes, an owner must allow it again.
See AI and your data.
Pause
Pause Cognis AI DBA stops every step for this connection until an owner resumes. Use it during an incident or a freeze.
Cognis AI DBA docs
The AI DBA fixes findings for you: safe BigQuery changes and GitHub pull requests, each one approved, logged, checked and reversible. On Growth, Pro and Enterprise.
GitHub pull requests
How the AI DBA opens fix pull requests for dbt models and query code, how to install the GitHub App, map repos, and run dbt Cloud CI. On Growth, Pro and Enterprise.