Let AI Agents Access Production Data Without Direct DB Access
Quantum_CS · reddit · 2026-07-17
The author proposes an alternative approach for AI agents to access production data: **instead of giving the model direct access to `execute_sql(sql)`**, place a runtime between the MCP client and Postgres/MySQL. This setup only exposes vetted semantic capabilities to the model, such as `billing.inspect_invoice` and `support.propose_plan_credit`. The core idea is to enforce permission boundaries outside the model. The model is restricted to reading specific rows and columns within a controlled contract, limiting its actions to "proposals" rather than direct "modifications." Actual approval, write-backs, replay logging, and auditing are all handled by the Runner. The author also incorporates tenant isolation, row/column constraints, version checks, idempotency, limits on affected rows, and a local SQLite/shared PostgreSQL ledger. The article emphasizes that while this design **does not prevent prompt injection**, it minimizes the blast radius. Mechanisms like batch writes, auto-approval thresholds, multi-person approvals, and reversible changes allow agents to process real business data without ever holding direct write permissions.
Related event: Secure Approaches for Enterprise AI Agents Accessing Production Data(2 posts)→
More from coding & agent
- The author says Codex reached 20x and is now debugging spec decoding on a hybrid parallel setup — TheZachMueller · 2026-07-21
- Axcess adds an MCP connector for WCAG accessibility checks that scanners miss — modelcontextprotocol · 2026-07-21
- X post asks whether Cursor Composer, built on Kimi models, would also be banned — max_paperclips · 2026-07-21
- A developer’s Codex usage is draining pooled enterprise credits at a small company — Distinct_Relation_62 · 2026-07-21
- Qwen Code ships cua-driver-rs 0.7.3 with relative coordinates and MCP filtering — github-actions[bot] · 2026-07-21
- Matt Pocock says every new codebase turns legacy within days — mattpocockuk · 2026-07-21