Teams want AI agents doing real work on real data, and projects stall on one question: what happens when the agent writes the wrong SQL? Prompts are requests, not controls, and roles decide what an agent may touch, not whether this statement should run. So we built database guardrails for AI agents: each statement is checked against deterministic rules before it reaches the database, and destructive ones come back with the reason and a fix. Here we write about SQL parsers, wire protocols and real AI agent incidents, including the parts of our own work that broke first.
Our stack
Rust (engine, proxy and CLI), libpg_query and sqlparser-rs for SQL parsing, Tokio, CEL for business policies, Ed25519 signing, TypeScript and Node.js (Fastify API), Next.js, PostgreSQL, MySQL, Redis, Python and Node SDKs, AWS (ECS Fargate, Aurora, Lambda, SQS), Cloudflare Workers, Terraform, GitHub Actions
