Objective: Take KB4's data team from "one semantic view per report" to a centralized, well-modeled gold semantic layer they can activate everywhere — including agentic access via a governed Snowflake MCP into Claude Cowork. Leave the room feeling they made real, hands-on progress toward their production AI vision.
Format: Half-day (~4 hr), ~30 attendees across the full org range.
Design principle — start at the destination, then high-level → low-level. Front-load the teaser + big picture so executives and busy managers get the value and can leave; curious managers + ICs stay for the hands-on build.
Core constraint: No access to KB4's sandbox ahead of time. The teaser/destination demo runs in phData's environment, framed as "by the end of today, this is implemented in YOURS." The live build during the day depends on KB4 provisioning a dev sandbox + sample data (confirm on Monday; phData-env build is the fallback).
The through-line (medallion)
- Bronze — raw source data. Inventory what KB4 has.
- Silver — business logic layer: events + entities = their ontology.
- Gold — semantic layer: aggregates ready for activation (Cortex Analyst, MCP).
Why this matters (the ask-#1 talk track): business logic used to be bundled per report → conflicting metric definitions. BI tools added shared models, but locked into the tool. Warehouse logic layers let multiple apps agree — but a semantic view per use case keeps the same risk. The endgame: a well-modeled silver business layer + the semantic layer as your gold layer. Centralize there, and you activate everywhere — BI, reverse-ETL into source systems, enriching other targets, Excel, and MCPs for agentic access.
Gary's demo ↔ this workshop (the blend)
Gary built a KB4-relevant app: Agentic Semantic Engineering for Vulnerabilities Intelligence, on the public National Vulnerability Database (NVD) enriched via CVE/CPE/CVSS/CWE/KEV/EPSS/MITRE ATT&CK. Three panels: KB-query (left) · Inspector / semantic-view detail (middle) · Cowork / Cortex-Analyst (right, Cortex Analyst only for now). The standout move: a covered NL question returns governed SQL; an uncoverable one triggers gap-detection → an extension recommendation → "Send to Architect" into the Inspector's extend section → the SV can be extended in-app only if the user's role allows it (RBAC enforced). A reusability advisor with coverage assessment, not bare text-to-SQL.
The blend (how the two pieces fit): Gary's app is the Part-1 teaser / destination demo — the "after." The workshop is the journey to it: raw → silver (events/entities) → gold semantic view → that exact app, live-built in their env. Spotlight to Snowflake: the gap-detection → Send-to-Architect → RBAC-extend loop — it answers ask #1 (stop making one SV per report) and ask #3 (governed reuse) in a single motion. The NL-query part is table stakes.
Run-of-show
Times are elapsed (0:00 = start). Absolute clock times slot in once the start time is confirmed.
PART 1 — everyone (~90 min)
| Elapsed | Segment | Objective | What happens |
|---|---|---|---|
| 0:00–0:08 | Welcome + framing | Set the arc | Intros (phData + KB4). "Here's where we'll be by the end of the day." |
| 0:08–0:20 | Teaser / destination demo | Create the pull | The end state, live in phData's env: a Claude Cowork agent answering NL questions over security-domain data through a governed MCP, RBAC in place. "This is the destination; today we build a piece of it in your environment." |
| 0:20–0:50 | Big picture | Exec-level value + vision | The semantic-layer evolution narrative + Bronze/Silver/Gold + "activate everywhere." Where AI/agents fit. The day's arc. |
| 0:50–1:30 | Events & Entities workshop (execs IN) | Define the Silver/ontology + capture domain knowledge | Facilitated: "Name YOUR business's entities and events." High participation — this is their business, not Snowflake mechanics. Whiteboard the core entities (users, campaigns, simulated-phishing events, training modules, accounts…) and the events that connect them. Execs/managers are the domain experts here; they leave having contributed. |
→ EXEC + busy-manager exit point.
| 1:30–1:40 | BREAK | Reset | Placed on the exec-exit seam: rest + covers departures gracefully + resets the room for the hands-on crew. |
PART 2 — curious managers + ICs, hands-on (~140 min)
| Elapsed | Segment | Objective | What happens |
|---|---|---|---|
| 1:40–2:25 | Semantic layer definition | Gold layer from the ontology | Turn the events/entities into reusable semantic view(s). Cortex Code (CoCo) intro to accelerate the Semantic View definition — also demonstrates rapid AI-assisted build. |
| 2:25–3:05 | Activation 1 — Cortex Analyst + Snowflake Intelligence | First activation | Author the Cortex Analyst semantic model over the gold view; ask NL questions; watch NL→governed SQL. Embed in Snowflake Intelligence as the first activation target. |
| 3:05–3:45 | Activation 2 — custom Snowflake MCP → Claude Cowork (RBAC) | The destination, built | Stand up / connect the custom Snowflake MCP exposing the semantic layer as typed tools; connect Claude Cowork via Custom Connector; demonstrate RBAC gating (a restricted role sees less). The teaser, now real on their (or fallback) data. |
| 3:45–4:00 | Close — roadmap + Q&A | Land it | Recap what got built. The gap from today's slice → production AI (governance, scale). Roadmap into their environment. Q&A. |
One 10-min break suffices for a half-day; add an optional 5-min stretch mid-Part-2 if energy flags.
Activation target (pick 1 for the live build)
Choose a single, vivid first activation aligned to KB4's world — e.g. "which simulated-phishing campaigns drove the biggest risk-score improvement by department." Narrow + recognizable beats broad.
Roles / materials
- Facilitator / flow owner: founder (ex-KB4, owns the pedagogy + the room).
- Demo + hands-on lead: Gary (building the E2E demo with CoCo).
- Case study: Crowdstrike (Dom) — security-peer reference.
- Pre-built: teaser demo + a fallback build mirroring KB4's data shape, in phData's env (so the day works regardless of KB4 provisioning).
Success criteria
Execs leave with the vision + proof phData can deliver it. ICs leave having built a real semantic-layer → Cortex Analyst → MCP → Cowork slice. Everyone leaves believing the production AI vision is reachable — and that phData is the partner to get them there.