In-depth analysis · About 5 min read
AWS compares three semantic-layer paths: shared metrics do not mean identical data or permissions
Denodo, Strategy Mosaic and AtScale answer a customer-360 question with different federation, identity and execution boundaries.
- Published here
- Source published
- Source checked
Three October 20 AWS partner guides apply Denodo, Strategy Mosaic and AtScale to a customer360 analytics pattern. They place business definitions and access rules outside an AgentCore-hosted agent’s prompt, but their data paths are materially different.
Listen to the news
Read this article aloud or keep listening to the news.
Preparing the reader…
Device voice
Speech is handled by your browser or device. AISubHub does not send the text to an audio API. Voice availability and playback with a locked screen vary by device.
Resuming may repeat a short phrase.
At a glance
- Denodo federates live sources including on-premises PostgreSQL; Mosaic links source-specific models; AtScale’s example first consolidates analytical data in Redshift.
- Human identity reaches different enforcement points. A shared metric or an MCP-compatible interface does not automatically make authorization, freshness or query meaning equivalent.
A governed metric removes one source of invention
The common retail example asks which high-spending customers have not joined a rewards program. Profiles, purchases and enrollment must be combined without the language model inventing a revenue formula or a join key. Each guide declares those meanings in a semantic model and supplies model metadata through MCP. The agent still interprets the question and chooses a query. This is an important division of work, not a guarantee of a correct answer. Granularity, non-additive ratios, missing enrollment records and the scope visible to a caller still require explicit tests.
Denodo federates across engines and can carry the user onward
Denodo maps Aurora profiles, Redshift purchases and on-premises PostgreSQL rewards data into base views, a derived customer view and a reusable metric view. Virtual DataPort plans native pushdowns and combines intermediate results; the agent writes VQL against governed objects. AgentCore Identity exchanges the caller’s token on behalf of the user for a Denodo-audience token. VDP independently validates it and applies tagged-column masking and row policies. Passing that identity onward to a source is optional and depends on compatible identity configuration; a service-account source connection has a different audit trail. The guide also describes caching and replication options. Its federation example therefore does not imply that no bytes ever move or that every deployment has no stored copy.
Mosaic links dimensional models and refreshes per-user access
Strategy Mosaic separates a Purchase model over Redshift from a Customer model over Aurora and joins source-level intermediate results on declared linking attributes. Named filters, metric formulas and aggregation levels carry business meaning. Its direct MCP path uses a Strategy authorization-code flow: a user-specific refresh token is stored in Secrets Manager, exchanged for an access token and resolved to a Strategy user. The certified-model gate, Use MCP Server privilege, row-level and object-level rules then apply. The documented query tool rejects writes and DDL. Live execution and an in-memory cube are alternatives with the same intended governance but different freshness and cost. The article ties its reference to Strategy One’s March 2026 release, not an October 20 first launch of MCP support.
AtScale moves the cross-source problem before the query
AtScale’s example replicates operational Aurora data into Redshift through DMS or Aurora zero-ETL, then defines dimensions, measures and perspectives in Git-versioned SML YAML. A query executes in one warehouse engine; cross-engine reconciliation belongs upstream or to warehouse-level federation. Demand-defined aggregates are materialized in the warehouse and can serve repeated queries, adding a maintenance and freshness consideration rather than guaranteeing a measured speedup. The production OAuth path uses AtScale’s Keycloak and the human’s role at the semantic layer; the final warehouse connection uses AtScale’s service identity. A development bearer token instead runs as its owner. These two authentication modes must not be presented as equivalent per-user auditing.
The same question still needs a semantic acceptance test
The Denodo guide contains two different operation orders: an earlier query filters unenrolled customers before limiting to twenty, whereas its later verification CTE first selects twenty spenders and then filters enrollment. Those can return different people. We retain that discrepancy instead of declaring the examples equivalent. Mosaic also reports an early mistake averaging customer-level share-of-wallet ratios; the authors say clarifying the metric description corrected their example. Our proposed acceptance set separates business interpretation from access enforcement: test the intended ranking/filter order, recompute ratios from their components and rerun as differently privileged users. Compare the answer with reference data while retaining generated and executed queries. No such tests were run by AISubHub.
Operational ownership and portability remain separate decisions
Denodo offers managed Agora with an execution plane in the customer’s account or a self-managed installation; Mosaic’s managed Strategy Cloud needs network access to sources; AtScale’s walkthrough operates on EKS with supporting identity, storage and cache services. Those choices affect ownership and recovery. Semantic metadata interoperability is not a portable security configuration: the Mosaic guide keeps governance and execution settings native even when exporting Apache Ossie definitions. A useful pilot should name the source-of-truth metric, freshness target, human enforcement point and responsible operator. Start narrowly and inspect denied requests and stale results as well as successful examples. None of the articles supplies a normalized full-cost or reliability comparison across all three products.
Why it matters
AISubHub analysis: select the data and identity boundary before choosing an integration. A convincing answer should be traceable to the metric definition, query plan, caller’s permissions and source freshness, rather than merely repeating a metric name.
Limits and availability
We read all three complete guides, including code and author roles, without deploying software, opening the linked documentation or verifying partner benchmarks. These are joint vendor reference accounts with different assumptions, not comparable performance measurements, universal compliance guarantees or new personal subscription benefits.
Sources and evidence
Source published: · Source checked:
Source published: · Source checked:
Source published: · Source checked:
AI-assisted editorial articles checked against linked primary sources. Vendor claims are attributed; inclusion is not endorsement.