Never Let Your Agent Touch the Database

Abstract

AI agents can be useful analytical interpreters without being given authority to author executable database programs. This position argues for an architectural separation between probabilistic interpretation, analytical adjudication, and physical execution. The model may interpret a request, search governed meaning, propose an analytical declaration, request clarification, and explain a result. A trusted analytical boundary should decide whether the proposed result is known, determinate, lawful, faithful to the request, and adequately supported; a trusted execution engine should retain database credentials and ownership of executable commands. The paper examines three risks created when those responsibilities are collapsed: security exposure, uncontrolled execution cost, and silent analytical failure. It distinguishes unrestricted or guardrailed text-to-SQL from constrained metric/dimension/filter interfaces and from a governed analytical request boundary. Constrained semantic interfaces are recognized as a strong safety pattern, but the paper argues that safety through restriction is not sufficient when the interface cannot express distinctions that belong to analytical meaning. Version 1.2 incorporates the current Theory of Data account of three structural sources of silent analytical failure—anchor, universe, and regime—and uses Frame-QL as an example of a request language designed to preserve meaning-bearing analytical distinctions without exposing physical database authority. The claim is architectural rather than product-specific: separate what a probabilistic model may propose from what a governed system is willing to authorize.