Databases

Conceptual

Read-first SQL access with query guardrails.

Database connectors default to a read-only role with statement timeouts, row limits and explain-before-execute for expensive queries.

Guardrails#

Guardrail	Default
Connection role	Read-only
Statement timeout	30s
Row limit	50,000 per query, streamed to a dataset above that
Plan review	Required when estimated cost exceeds the threshold
Schema access	Allowlisted schemas and tables only
Writes and DDL	Disabled unless explicitly granted, approval always
Column masking	PII columns masked at the connector level

Generated query with guardrails applied

-- statement_timeout = 30s, row_limit = class="tok-num">50000
SELECT
  date_trunc(class="tok-str">'day', created_at) AS day,
  count(*)                      AS orders,
  sum(total_cents) / class="tok-num">100.0      AS revenue
FROM analytics.orders
WHERE created_at >= now() - interval class="tok-str">'class="tok-num">90 days'
GROUP BY class="tok-num">1
ORDER BY class="tok-num">1;

Last updated 2026-09-07