dbSDK
Resources
PatternAISecurityPostgreSQL

Run a model-written query

The app owns the model and the API key. DB SDK takes the catalog out, treats the query as untrusted input, and runs a bounded read.

The application owns the model and the API key. DB SDK takes the catalog out, treats the query as untrusted input, and runs a bounded read. Prompt instructions are not a security boundary.

agent.ts
const catalog = await db.introspect();
const sql = await model.generateQuery(catalog, prompt);

const result = await db.query({ sql, params });
// generated SQL is untrusted input
Never skip provider checks because the model was instructed to only SELECT. Prefer a read-only database user as the real lock — SDK validation is extra.

What stays in the host

  • The model, the prompt, and the AI API key
  • Tenant checks and credential decryption
  • How much of the catalog you show the model

DB SDK does not call a model. If a host skips tenant scoping or ships a writable role, that is a host bug, not “DB SDK has write access.”

Keep going

Guide

Security model

Treat generated queries as untrusted. SDK checks are extra — the lock is a read-only database role.

Reference

Read-only role checklist

What the host, the customer, and the SDK each own. Prefer a dedicated SELECT-only user or read-only IAM principal.

Guide

Core idea

Connect, describe, and read a database whose schema you don't control at compile time — without turning every driver into SQL.