Move the work, not the data

A second analytics store brings its own credentials, retention rules and access policies. Those are part of the deployment cost even when the query itself is simple.

KEZEL puts an agent beside the databases your team already operates. The control plane builds a plan from schema metadata and intent; the agent pulls an encrypted instruction and executes it locally. Raw records and computed results remain in the approved environment.

Access is part of the execution plan

Your policy defines who may run a request and who may read its result. Row filters, column masks and minimum cohort sizes are applied in the plan. A dashboard or API reads the resulting view inside the same environment, through the policy gate.

The audit ledger records the question, policy decision, reader and timestamp. Lineage links published figures to their source tables and transformations. An evaluator can inspect the data access that produced a result.

Your team operates the compute

Local execution means your team supplies capacity and operates the agent. The security review still needs to cover the runtime, source credentials, policy file and permitted egress destinations. Removing a second data store does not remove that work.

For a pilot, choose a workload small enough to inspect in detail. The request walkthrough shows the execution steps and deployment options your team will need to review.