Rudder Lookout is currently in Public Beta. Contact the Product team if you have any questions.
The Lookout agent requires access to your data warehouse to answer questions about your data.
The agent lists tables, inspects schema, and runs SQL to answer questions, build dashboards, and investigate your pipelines. The results flow straight into charts, tables, metrics, and funnels.
Lookout supports the following warehouses:
Only admins can create, connect, edit, and test a warehouse connection. See Roles and Permissions for more information.
Note that:
Follow these best practices to ensure a smooth and secure connection to your warehouse.
For every warehouse, connect Lookout through a dedicated service identity that has read-only access rather than reusing a person’s credentials or an account with broad privileges. This isolates RudderStack’s access to your warehouse, keeps it strictly read-only, and makes it easy to audit or revoke independently of anyone’s personal login.
Each platform has its own name for this kind of identity, but the principle is the same — create an identity, grant it read-only access to the data Lookout needs, and use it for the connection:
| Warehouse | Identity to create | Access to grant |
|---|---|---|
| Snowflake | Service user with a dedicated read-only role | SELECT on the relevant databases/schemas |
| BigQuery | Service account | Read-only roles (for example, Data Viewer + Job User) |
| Databricks | Service principal | Read-only grants on the relevant catalogs/schemas |
| Redshift | IAM service user / dedicated database user | SELECT on the relevant schemas |
| PostgreSQL | Dedicated database role | SELECT (read-only) on the relevant schemas |
| ClickHouse | Dedicated database user | SELECT (read-only) on the relevant databases |
Scope the grant to only the databases, schemas, and tables Lookout needs. Read-only, least-privilege access keeps the connection’s blast radius small.
Note that creating a service account, role, or user, and granting it read-only access usually requires warehouse-administrator privileges. If you don’t manage your warehouse directly, reach out to your Infra team to have it set up.
The exact credentials and permissions each warehouse needs are shown on its connection page in Settings > Connections > Warehouses.
The following recommendations help Lookout respond quickly while keeping costs predictable. They are written with Snowflake in mind, but the same principles apply to other warehouses — the exact settings may differ:
Warehouse access is strictly read-only. The agent can query and inspect your data, but it can’t write to or alter your warehouse.
Note that:
See Security and Data Handling for more information.
Once a warehouse is connected, the same connection powers the following Lookout features: