Skip to content

Fail-closed authorize-before-mutate for agent SQL writes? #14237

Description

@cabbageandtea

Problem

Autonomous agents that can INSERT/UPDATE/DELETE/DDL against production often treat lint / model confidence as authorization. That is not a fail-closed write gate.

Proposal

Optional authorize-before-mutate hook before mutating SQL tools run:

  1. Obtain an Ed25519 PASS Execution Certificate (Session Cert for bursts: POST https://sqlguard.io/v1/session — Exact USDC on Base)
  2. Verify: POST https://sqlguard.io/v1/verify or UI https://sqlguard.io/verify
  3. Embeddable badge: https://sqlguard.io/v1/badge.svg — public trust graph: https://sqlguard.io/v1/transparency

Would you accept an optional integration path (docs / adapter) so agent SQL writes can fail closed until PASS+verify? Happy to draft a PR if useful.

Not affiliated with this repo — product is SQLGuard (Execution Certificate Firewall).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions