Skip to main content
The Google BigQuery integration brings your warehouse into client work. Ask how Contoso’s weekly basket size moved by region since the October price change, check a figure in a draft against the source tables, or profile a table before analysis, and Hebno writes and runs a read-only GoogleSQL query in BigQuery, shows the query, and cites the tables it used. Hebno never writes to BigQuery.

​
At a glance

​
Before you start

You need:
  • An owner or admin role in Hebno.
  • A Google Cloud project where Hebno runs query jobs, and the projects that contain the datasets you want to query.
  • A Google Cloud user who can create service accounts and grant IAM roles, such as a project owner or a user with Service Account Admin and Project IAM Admin.
Create a service account in the Google Cloud console under IAM & Admin → Service accounts, for example hebno-reader@northwind-analytics.iam.gserviceaccount.com, and grant it these roles: Grant BigQuery Data Viewer on datasets, not on the whole project, so the service account reads only the datasets you choose. Do not grant BigQuery Data Editor, BigQuery Admin or any role with write rights. Hebno accepts only SELECT statements and runs each one as a query job with no destination table. Then open the service account, select Keys → Add key → Create new key, choose JSON and download the key file.
If your organisation enforces the iam.disableServiceAccountKeyCreation policy, use workload identity federation instead. Hebno shows the workload identity pool provider details on the Google BigQuery card under Admin → Connectors.

​
Connect Google BigQuery

1

Allow the integration

Open Admin → Connectors → Catalogue, find Google BigQuery under Data and analytics, and set it to Allow.
2

Connect the organisation

Select Connect, upload the service account key file, choose the project for query jobs and the default location, such as EU or europe-west2, then select Test connection. Hebno lists the datasets the service account can read.
3

Choose teams and data areas

Under Who can use it, choose All teams or pick teams. Under Data areas, choose the datasets each team can query. See Data areas.
4

Set a scan limit

Under Maximum bytes scanned, set the largest amount of data a single query may read. Queries above the limit fail before they run.
The card shows Connected with the service account email. Members in the selected teams can use BigQuery in chat straight away. Members can link their own Google account so queries run with their own IAM roles, row-level security and column-level access policies.
  1. In Hebno, open Settings → Connections, find Google BigQuery and select Link your account.
  2. Sign in to Google and approve read access to BigQuery with the https://www.googleapis.com/auth/bigquery.readonly scope.
Your Google account needs BigQuery Job User on the query job project and BigQuery Data Viewer on the datasets. If your Workspace restricts third-party access, a super admin marks Hebno as trusted first. See Google Workspace admin.

​
Data areas

Data areas control what members of the allowed teams can query through the organisation connection. They apply on top of the service account’s IAM roles.
Admin connector panel showing who can use it, access and data areas

An organisation connection with team access and data areas. Financial figures default to owners and admins.

To let the Contoso team query only its own dataset, open the BigQuery card in Admin → Connectors, select Datasets, and give northwind-analytics.contoso_retail to that team only.
When a member has linked their own account, Hebno uses that member’s IAM roles instead of the service account. Data areas still apply, so a member never sees more through Hebno than both BigQuery and your Hebno settings allow.

​
What Hebno reads

Chat reply citing a BigQuery query result

A BigQuery query result attached to a chat.

Hebno reads table schemas and descriptions from INFORMATION_SCHEMA to write the query, runs a dry run to check it and the data it would scan, then runs it and shows the SQL with the reply so you can rerun it in BigQuery Studio. On partitioned tables, Hebno filters on the partition column where the question allows. Results are capped at a row limit set on the card, and the reply says when a result was cut off. Each job has the label source: hebno, so an admin can find it in INFORMATION_SCHEMA.JOBS. Reads are live. Hebno runs each query in BigQuery when a request needs it and does not copy tables. Only what a reply used is stored with the conversation as its sources.

​
Hebno reads only

Hebno does not write to BigQuery. It does not run INSERT, UPDATE, DELETE, MERGE or CREATE statements, write query results to tables, load or export data, or change IAM. Linking marks which datasets or tables belong to an engagement, so you can ask “how did basket size move last week?” without naming the table.
  1. Open the project and select Brain.
  2. Under Linked records, select Link record, then Google BigQuery.
  3. Search by project, dataset or table name and select it. Repeat for each one the engagement uses.
In chats tagged to the project, Hebno starts with the linked datasets and tables when it writes a query. See Linked records.

​
Use Google BigQuery in chat

  • Attach: open the + menu, choose Sources → Google BigQuery, and pick a dataset, a table or a view. Or type / and choose Google BigQuery.
  • Ask: name the metric, table or period in your request. For example:
    Show weekly Contoso basket size and transactions by region since 1 September, from contoso_retail.
    Check the store count in the draft readout against the stores table and show the query.
    Profile the transactions table: date range, row count by month and share of null store IDs.
  • Research runs show a Querying BigQuery step, with the SQL and a chip for each table it read.
  • Agents can query BigQuery on a schedule, for example a Monday table of last week’s basket size by region. Writes an agent proposes elsewhere appear in agent approvals for review.

​
Troubleshooting