When we set out to build a natural language text-to-SQL agent for self-serve analytics, the objective was clear: enable business users, regardless of technical background, to ask a business question in plain English and receive a reliable, data-backed answer in seconds. However, delivering on that promise required solving a more complex challenge beneath the surface.

In this post, we show you how PAR built a production-ready multi-tenant LLM analytics system that enforces row-level security through a three-layer architecture: cryptographic request signing with AWS SigV4, semantic validation on Amazon Bedrock, and programmatic data isolation via Split-Plane SQL.

We demonstrate how each layer operates independently to reduce the risk of cross-tenant data exposure, even when the LLM itself is compromised or manipulated.

The core problem sits at the intersection of data access, correctness, and security at scale. Our system must simultaneously support thousands of users, each tied to different businesses, datasets, and permission boundaries. Every query generated by the agent must not only be accurate, but also strictly scoped to the data that user is authorized to access. In other words, the challenge isn’t only generating SQL. It’s generating the right SQL, for the right user, against the right slice of data, every single time.

Consider two users who open our analytics agent on the same morning and ask the exact same question: “What were total sales last week?”