AI-generated HTML dashboards draw level with $150k Looker at 500-person company

A side project that caught the enterprise tool

A three-engineer data platform team says an internal service for hosting AI-generated HTML dashboards, originally built in a single afternoon, has drawn level with their company's roughly $150,000-a-year Looker deployment in weekly users — and Looker usage has fallen by about a third. The account was published on the blog david.lequin.dev and reached the Hacker News front page.

The author describes a company of about 500 people paying for roughly 300 Looker seats, where the data team spends most of its time on Snowflake, a dbt project that passed 2,000 models, and the surrounding Airflow, Airbyte, DataHub and Kubernetes plumbing.

From stray files to an internal platform

According to the post, the turning point came in early January, when Claude Code running Opus 4.5 became good enough that staff in finance, operations and marketing who had never opened a terminal were prompting all day instead of clicking through dashboards. Crucially, the assistant could run a query to verify numbers before answering, which mattered more than fluent prose.

Claude's output increasingly took the form of single-file HTML pages with charts — often, the author claims, better looking than the company's Looker tiles, which are limited to fixed chart types and colours. The problem was distribution: those pages piled up on individual machines and travelled by Slack attachment. In February, an engineer on the team spent an afternoon building a small hosting service — files in S3, SSO in front, a few tests — deployed through the company's existing Terraform and Helm setup. A Python script packaged as a Claude plugin let anyone push a generated page to the internal domain.

The warehouse became the permission system

In March the team added a live query API that executes SQL with the viewer's own Snowflake OAuth token. That eliminated the need to build a permission model: Snowflake roles maintained over years already decide who can read what, and if the warehouse refuses the sales table, the dashboard inherits the refusal. By April, Snowflake OAuth was the only login.

Reported adoption grew quickly: 23 weekly viewers in March, 136 by June, with email and Slack exports arriving in April and dashboard parameters in May. Users scheduled dashboards to regenerate themselves, added buttons, and produced layouts the author says no conventional BI tool would have allowed.

Security forced a proper rebuild

The first version was, by the author's own admission, dangerous: dashboard JavaScript ran on the same origin as user sessions, per-dashboard permissions did not exist, and any page could effectively act as whoever opened it. The team shipped it anyway because it sat behind the VPN and SSO, and nothing else did the job.

Once a large share of the company depended on it, the team rebuilt deliberately. A single remote MCP connector replaced upload scripts that had drifted across multiple repos and a plugin; it forwards the user's Snowflake token, and the API verifies identity with SELECT CURRENT_USER(). Anything an AI uploads lands as a draft until a human clicks publish. Each dashboard now runs in a sandboxed iframe on its own origin, with no cookies and a strict content security policy, talking only to a parent shell via postMessage. Content tokens expire after an hour and are scoped to one dashboard, one viewer and one host.

One rule survived unchanged: anyone can still publish any HTML in one prompt, with no review step, template or approved widget list. The author argues governance already happens upstream in dbt models and Snowflake roles, and that every obstacle placed between people and their dashboards pushes them back to unshared local files.

Why it matters

If the reported numbers hold up, this is a sharp data point in the debate over whether AI-assisted development erodes B2B SaaS: three engineers, an afternoon of initial work and a warehouse that already knew who could see what, competing with a six-figure enterprise contract. It also reframes where governance belongs — in the data layer rather than the BI layer — though that only works for teams whose Snowflake roles and dbt models are already well maintained. The caveats are real: this is one unverified account from a team already fluent in Kubernetes, Terraform and dbt, and the genuinely hard engineering turned out to be making arbitrary, unreviewed JavaScript safe to share, not generating charts. For mid-sized engineering teams, the lesson is less about cancelling BI contracts and more about questioning which costs the dashboard layer was ever actually covering.