Dedicated CDF environment for AI agent & app development

Dedicated CDF environment for AI agent & app development

We've been working through how to give AI agent and application developers a proper home in CDF, and wanted to share the approach we're exploring in case it's useful to others facing the same thing.

The problem we hit

A standard dev / test / prod setup works well for governed data pipelines, but it gets awkward for AI agent and app development, which needs two things that are hard to provide together in those environments:

• Representative production data — dev is typically fed by a non-representative subset, so agents and apps built there don't behave the same once they meet real data.
• Broad, globally-scoped rights to create and edit agents and apps. Since creation rights are global within a project and can't be scoped down to a space — even with Row-Level Security — granting them in a shared dev project exposes every other workload there.

The approach we're exploring

A dedicated CDF environment (separate project) running parallel to the governed dev/test/prod environments:

• A read-only, one-way mirror of real production data, so developers build against representative data without any write path back to prod.
• Writable experimental spaces for the instances (and possibly data models) that agents and apps generate.

The idea is a two-layer containment: the project boundary holds the global creation rights, and RLS governs data access within the environment.

Why we're leaning this way

• It's the only way we've found to contain those global creation rights — a separate project is the only reliable boundary, and it confines them to a blast radius that holds nothing critical.
• Developers get real production data without ever touching prod or its compute.
• The governed dev → test → prod flow stays untouched.
• Experimentation, schema churn, and failed PoCs stay isolated from everyone else.