Enterprise AI pilots may encounter difficulties not only when a model generates incorrect SQL, but also when teams lack visibility into those errors or must grant the agent broad access to test its output.
Data teams have had two ways to give an AI agent access to a production database, and neither works particularly well.
Saying no has stalled countless pilots at the security review. Handing over a credential is the alternative, and that approach already has a public record.
Today Agentic Fabriq is releasing mnemiq, an engine proposing a third option: a governed connection with policy attached and evidence for every answer.
The company's line is simple: proof, not promises.
What it actually does
mnemiq sits between the language model and the database.
The model proposes SQL. Four deterministic checks decide whether that SQL ever runs: its shape must match an approved pattern, the relevant grants must cover every table touched, the query must transpile cleanly, and its query plan must match what the policy permits.
If one of those checks fails, the system is designed to decline the request rather than generate an uncertain response.
For AI agents, mnemiq ships as an MCP server with three tools — db_read, db_write and get_schema — with grants applied per tool rather than per connection.
The system is designed so that the agent does not directly hold the underlying database credentials. It receives a token that maps to a defined policy.
That distinction is important because declining more difficult questions can increase a system’s reported accuracy among the questions it answers.
When a query does run, mnemiq records the SQL behind the answer, the tables read, the semantic-layer version, timing and cost.
Agentic Fabriq calls this a receipt.
The idea is that a reviewer should be able to reconstruct an AI-generated answer six months later rather than simply trust that the model got it right.
The company also publishes its threat model and draws a line around what the open-source engine does not claim to solve. The engine enforces the grants it receives; authentication and identity are handled by Agentic Fabriq's commercial control plane.
“The failure mode people worry about is the agent doing something destructive,” said Paulina Xu, who leads the project at Agentic Fabriq. “The failure mode we kept seeing was quieter. The agent returns a number, the number is wrong, and it looks exactly like a right number. Nobody catches it until it's in a board deck.”
The number the category rarely reports
Restricting access solves only part of the problem. The harder question is what happens when an authorized agent confidently produces the wrong answer.
That is where database AI still faces a measurement challenge. Reported accuracy can vary considerably depending on the model, semantic context, dataset and testing method. These results suggest that better context may sometimes matter as much as model choice, but differences among benchmarks make direct comparisons difficult.
For buyers, that leaves one especially important question:
How often did the system return a wrong answer rather than refuse to answer?
That distinction matters because a system can improve its apparent accuracy simply by declining more difficult questions.
mnemiq therefore reports three outcomes:
right, refused, and wrong.
Agentic Fabriq says it has evaluated the system on more than 1,100 graded questions across three corpora and is publishing the harness and grader used to produce the results so that the methodology can be rerun independently.
That approach is more useful than a single headline accuracy number because the three figures constrain one another. Reporting refusal and incorrect-answer rates alongside accuracy can provide a more complete picture of system performance.
“Refusal rate is the check on the accuracy figure,” Xu said. “If you don't report it, you can buy any accuracy number you want by answering less often.”
Agentic Fabriq is also publishing the experiments that failed.
According to the reported results, increasing model size yielded limited improvement, while fine-tuning and majority voting did not fully address the issue. The findings suggested that some errors were systematic, with multiple models producing the same incorrect result.
The interventions that helped were comparatively unglamorous.
That finding may ultimately prove more useful than another model leaderboard.
Enterprise systems usually know something about their own data. Schemas have definitions. Metrics have business meaning. Access policies exist. The question is whether an AI system can use those constraints reliably rather than pretending every database is a puzzle presented cold.
Where mnemiq is weaker
mnemiq does not currently lead the major public text-to-SQL benchmarks, and Agentic Fabriq does not pretend otherwise.
Agentic Fabriq's argument is that these benchmarks test a regime unlike the one most enterprises actually deploy: an unfamiliar schema, limited organizational context and no opportunity to enrich the environment.
That result deserves the same scrutiny Agentic Fabriq applies to competitors. It is measured on the company's own questions, using its own system.
The company's answer is not that buyers should simply trust the number. It is that the benchmark procedure, harness and grading rules should be available for inspection, with gold answers maintained separately from the engine doing the answering.
There is independent evidence that benchmark methodology matters. There is also an obvious criticism of mnemiq's emphasis on refusal: refusing is itself an easy way to avoid being wrong.
That is exactly why right, refused and wrong have to be published together.
Refusal, accuracy and incorrect-answer rates are most informative when reported together, as any one metric may provide an incomplete view of performance. An accuracy rate without a wrong-answer rate can be equally misleading.
Refusing to answer isn't a new idea
Agentic Fabriq also isn't claiming to have invented abstention.
Research including TrustSQL explored the problem in 2024. AbstentionBench has treated reliable abstention as an unresolved challenge. An August 2026 arXiv paper described a related deterministic-kernel architecture under the term structural abstention.
The distinction Agentic Fabriq wants to establish is practical rather than historical: mnemiq has code, evaluation infrastructure and deployable controls around the concept.
That is also why publishing the methodology matters.
Every company selling enterprise AI eventually asks its customer to trust a claim.
The more interesting systems are beginning to provide a way to check it.
The open-core question
Agentic Fabriq says mnemiq is complete on its own rather than a deliberately crippled community edition.
Alongside it sits Verity, designed for trust scoring and drift detection, and Agentic Fabriq's commercial control plane for identity, vaulted credentials, group-level grants and evidence storage.
That creates the usual open-core question: where does the genuinely useful open product end and the commercial dependency begin?
Agentic Fabriq has at least made the seam explicit.
Whether that boundary remains as clean as enterprise adoption grows will be one of the things worth watching.
Why enterprise buyers care
The problem is increasingly moving beyond engineering teams. That may ultimately be the more important market shift.
The first phase of enterprise generative AI was dominated by the question:
Can the model do this?
The second is increasingly:
Can what it did be proven?
A test any buyer can run
Agentic Fabriq proposes a straightforward test.
Take one meaningful slice of your company's schema.
Write 20 to 30 questions that employees genuinely ask about that data.
Run them through the system.
Then measure three things separately:
Right. Refused. Wrong.
Do not combine them into one score.
Do not allow an unanswered question to disappear into the denominator.
And do not accept an answer without being able to inspect how the system produced it.
The exercise can be done in an afternoon.
Surprisingly few enterprise buyers currently run it.
That is part of the reason 90%-plus accuracy claims can coexist across products that behave very differently once they encounter a real company's schema, permissions and business definitions.
mnemiq is not currently the highest-scoring system on the public text-to-SQL leaderboards.
That isn't the claim.
Its more interesting proposition is that enterprise AI systems should be judged not merely on whether they generate an answer, but on whether they can justify it, refuse it when necessary and leave evidence behind.
For a category built around trust, that is a considerably harder standard.
And now there is open-source code against which to test it.
VentureBeat newsroom and editorial staff were not involved in the creation of this content.