Your report still renders. The number moved.
Someone widens a column, renames a measure, or adds a visual that cross-joins two dimensions. Nothing breaks. Nothing fails. The number is simply wrong now, and nobody knows which number.
AnalyticsGuard signs off your warehouse, semantic model and reports once — then guards every layer against drift, rule by rule.
A warehouse fails quietly
Application bugs announce themselves. A wrong number does not — it looks exactly like a right one.
Drift is silent by design
A source column widens from smallint to int. Bronze copies it, Silver inherits it, Gold casts it. Every layer keeps running, every report still renders, and nothing fails a test.
The reasoning lives in people
Why is that tag number degenerate? Why is trades a concatenated column instead of a bridge? The answer is in someone's memory, or a chat thread from eight months ago.
Nobody ever signed anything
When a number gets questioned, there is no record of who agreed the model was right, when they agreed it, or what has changed underneath it since.
Baseline once. Guard continuously.
The same shape as every guardian: a human approves what correct looks like, and the machine holds everything to it afterwards.
Harvest
Reads INFORMATION_SCHEMA across bronze, silver and gold; the semantic model's TMDL including every measure's DAX; the report definition down to pages, visuals, bindings and filters; and the loader procedures behind each table.
Runs inside your tenant, on your schedule.
Baseline
Every object carries its grain, its Kimball class and the reasoning behind it. Multiple people sign off per object — a data lead, an architect, the business owner who actually reads the report.
That signed state becomes the baseline.
Guard
Each re-harvest re-evaluates the rule catalog and compares against the baseline. Anything that moved stales its sign-off. Anything new arrives flagged as undocumented, so it cannot quietly join the model.
Nothing is ever silently rewritten.
Three families of rules
Each rule declares what it governs and how it is evaluated, so coverage is a measured number rather than an inferred one. Every verdict carries the evidence behind it.
Medallion
Layer responsibilities
- Silver keeps its source's native types — a bronze smallint that surfaces as a silver int is flagged, naming both columns
- A loader feeding a silver table reads one bronze source; two implies a join that belongs in Gold
- Casting belongs to Gold, and Bronze stays a verbatim copy
Kimball
Model structure
- Every fact and aggregate table declares its grain
- No dimension-to-dimension relationships in the semantic model
- A concatenated column has a bridge table behind the concept
- A degenerate key sits on the fact, not on a dimension holding a key and nothing else
Engine
Report behaviour
- A wide visual groups by a single table
- No time-intelligence or window functions buried in a measure's DAX
- A visual grouping across two dimensions carries a not-blank measure filter to anchor the fact
And a record that survives the people who wrote it
A catalog tells you what exists. This tells you what was decided, by whom, and whether it still holds.
Append-only decisions
A decision is never edited. Corrections supersede the row they replace, so the reasoning that was true last quarter is still readable this one.
Multi-signer sign-off
One current row per object per signer. Any open issue wins; everyone signed means signed off. When the object changes, every signature on it goes stale at once.
Questions where they belong
Threads attach to any object, rule or decision — so 'why is this like this' is asked and answered against the thing itself, not in a chat that scrolls away.
Full revision history
Every mutation records what it was and what it became. Sync retires objects rather than deleting them, so the record only ever grows.
What it does not claim
A wrong verdict in a system of record is worse than an absent one. These are the edges, stated rather than implied.
- It checks design, not speed. The engine rules predict cost from structure — they do not measure refresh durations or capacity consumption.
- Some rules stay manual, and each one names the specific evidence it lacks and what would lift it. A stated gap beats a confident guess.
- Where a check cannot decide — a relationship whose endpoint will not resolve, a column whose name matches two sources that disagree — it records indeterminate with the reason. It never guesses.
- The engine never issues an exception and never overwrites a human verdict. Permitting a violation stays a person's decision.
Where it runs
Your warehouse metadata describes your business. It stays where your warehouse is.
Runs in your tenant
Your subscription, your data boundary. Provisioned as infrastructure-as-code and operated by Pintor — releases, upgrades and monitoring included.
Metadata never leaves
The harvester runs client-side, next to the warehouse, and pushes a snapshot to your own instance over an authenticated ingestion endpoint.
Sign in with Entra ID
Your existing identity, your existing groups. No local accounts, no separate password to operate.
Find out what your model is not telling you
We are taking a small number of design partners on Microsoft Fabric. A first harvest tells you more about your warehouse than a month of reviews.