QueryShield › Guides

How do I give an AI agent safe access to a production database?

The goal is not zero access — an agent that cannot read anything is useless. The goal is bounded access: enough to do the work, constrained so that a mistake or an injected prompt cannot become an incident.

Why the usual advice falls short

A read-only database user stops writes, but it does not stop an agent from reading every row in every table it can see, running a query that saturates your database, or holding a connection open. A read replica protects write traffic but not the data itself. Neither gives you per-agent scoping or a query-level audit trail.

The layers that actually bound the blast radius

• A proxy, not a connection: the agent talks to an API, so credentials stay out of its reach entirely.
• AST validation: parse each generated query and allow only a single SELECT — no stacked statements, no DDL, no forbidden functions.
• Mandatory LIMIT: one call can never drain a table.
• Per-agent row-level security: scope is enforced deterministically outside the model, so no prompt can widen it.
• Append-only audit: every accepted and rejected query is recorded against a specific agent.

Start read-only, then widen deliberately

Give each agent its own key and its own policy, point analytics agents at a replica, and review the audit log before loosening any scope. QueryShield applies every layer above by default, so “safe access” is the starting configuration rather than something you assemble yourself.

Related guides

• How do I block DELETE and DROP from LLM-generated SQL?
• How do I prevent SQL injection from LLM-generated queries?
• How do I enforce RBAC for AI agents accessing a database?
• How do I stop an AI agent from seeing database credentials?
• What is a query firewall for AI agents?