{"uid":"cap_H4xWOiNCWLoFudorHBDIc","slug":"sqlpermit-sql-guard-9d8d6a70","name":"SQLPermit SQL Guard","description":"Decide whether an agent-authored PostgreSQL statement complies with an execution policy, using PostgreSQL's own parser rather than pattern matching. Detects statement stacking, data-modifying CTEs, COPY PROGRAM, privilege changes, and dangerous functions that read as ordinary SELECTs. Returns reason codes and an optional short-lived signed permit bound to the exact normalized statement. Never connects to your database.","url":"https://sqlpermit.schemasure.com/v1/guard/sql?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"sql":{"type":"string","maxLength":100000,"minLength":1},"policy":{"type":"object","properties":{"max_rows":{"type":"integer","minimum":1,"description":"Row ceiling. Becomes a permit obligation the executor enforces."},"read_only":{"type":"boolean","description":"Reject anything that can change data or schema, including writes reached through a CTE."},"allowed_tables":{"type":"array","items":{"type":"string"},"description":"Permitted relations as schema.table, or a bare name to match an unqualified reference."},"allow_returning":{"type":"boolean","description":"Accept RETURNING on a permitted write without a warning."},"allow_row_locks":{"type":"boolean","description":"Accept SELECT ... FOR UPDATE without a warning."},"allowed_schemas":{"type":"array","items":{"type":"string"},"description":"Schemas the statement may reference."},"allowed_functions":{"type":"array","items":{"type":"string"},"description":"Added to the built-in allowlist. Bare name, or schema.function to admit one of your own."},"allowed_languages":{"type":"array","items":{"type":"string"},"description":"Permitted CREATE FUNCTION languages. Defaults to none."},"statement_timeout_ms":{"type":"integer","minimum":1,"description":"Timeout written into the permit obligations. Defaults to 30000."},"allow_multi_statement":{"type":"boolean","description":"Permit more than one statement in the input. Defaults to false."}},"additionalProperties":false},"dialect":{"enum":["postgresql"],"type":"string"},"subject":{"type":"string","description":"Opaque caller label recorded as the permit subject."},"audience":{"type":"string","description":"Identity of the ONE executor the permit is for. Required when issue_permit is true. Wildcards are rejected."},"issue_permit":{"type":"boolean"},"target_pg_major":{"enum":[18],"type":"integer","description":"Required. The PostgreSQL major the statement will run on. Only 18 is supported in v1: a permit issued under one grammar and verified against another is a parser differential."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_PnAOpUm7bugb1lSHTFvtM","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Validates an agent-authored PostgreSQL statement against a configurable execution policy using PostgreSQL's real parser, returning compliance decisions, reason codes, and optional short-lived signed execution permits.","exampleAgentPrompt":"Before running this query on our PostgreSQL 18 database, check it against our read-only policy with a max of 1000 rows and only allow access to the public.orders and public.customers tables — and issue a signed permit if it passes: SELECT o.id, c.name FROM public.orders o JOIN public.customers c ON c.id = o.customer_id WHERE o.status = 'pending' LIMIT 50","exampleUseCases":[{"title":"Read-only agent query gating","prompt":"I have an AI agent that generates SQL for our analysts. Before any query hits our PostgreSQL 18 database, check it's truly read-only, only touches the reporting.events and reporting.sessions tables, and issue a signed permit if it passes — here's the statement: SELECT session_id, count(*) FROM reporting.events GROUP BY session_id LIMIT 500"},{"title":"Detect dangerous function abuse","prompt":"One of our agent-generated queries looks like a plain SELECT but I want to make sure it's not calling something dangerous like pg_read_file or lo_export. Can you run it through the SQL guard with a read-only policy on PostgreSQL 18 and tell me what reason codes come back? The query is: SELECT pg_read_file('/etc/passwd')"},{"title":"Multi-table write policy enforcement","prompt":"Our agent submitted this SQL that includes a WITH clause — I need to know if it tries to modify any data or schema, even through a CTE. Policy is read-only, allowed tables are inventory.products and inventory.stock, PostgreSQL 18, and flag any row lock usage too. Statement: WITH moved AS (UPDATE inventory.stock SET qty = qty - 1 WHERE id = 42 RETURNING id) SELECT * FROM moved"}],"resultDescription":"Returns a compliance decision (allowed/denied), one or more machine-readable reason codes explaining any policy violations detected (e.g. WRITE_DETECTED, FORBIDDEN_FUNCTION, STATEMENT_STACKING, COPY_PROGRAM), the normalized form of the parsed statement, and — when issue_permit is true and the statement passes — a short-lived cryptographically signed permit bound to the exact normalized statement and the specified audience executor, carrying obligations such as max_rows and statement_timeout_ms.","failureModes":["Unparseable SQL returns a parse error reason code rather than a compliance decision","Unsupported PostgreSQL major version (anything other than 18) returns a 400-level rejection","Missing required target_pg_major field causes validation error","issue_permit=true without an audience value is rejected","Wildcard audience values are rejected when issuing permits","Statements exceeding 100,000 characters are rejected at input validation","Payment not included or invalid x402 payment causes 402 response before processing"],"whenToPreferThis":"Use SQLPermit when an AI agent or untrusted process generates SQL that will be executed against a real PostgreSQL database and you need policy enforcement backed by PostgreSQL's actual parser rather than regex or string matching. It is specifically valuable when you need to catch dangerous patterns that look like benign SELECTs — such as data-modifying CTEs, COPY PROGRAM, or privilege-escalating function calls — and when you want a cryptographically signed, short-lived permit that the executor can verify before running the statement, creating a clear audit chain between policy decision and execution.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-13T00:31:44.875Z","isFirstParty":false,"canonicalSlug":"sqlpermit-sql-guard-9d8d6a70"}