As companies explore the capabilities of AI agents that extend beyond simple information retrieval, a significant challenge is surfacing within the data management layer: ensuring proper enforcement of rules within databases. Allowing these autonomous systems to interact directly with operational databases prompts an essential yet complex question for IT infrastructure teams: where should the safety measures, or guardrails, be implemented?
A number of database providers and scholars suggest that these safety mechanisms ought to be integrated directly into the databases. If AI agents are to generate and execute SQL queries, it becomes crucial to enforce role-based access control, row-level security, and transactional constraints right where the data resides. This realignment could potentially reshape the architecture of databases, the level of integration between AI orchestration systems and transactional databases, and the regulatory measures that dictate how autonomous workloads handle enterprise data.
Among those advocating for this shift is CedarDB, a database company that emerged from a research initiative at the Technical University of Munich, focusing on hybrid transactional and analytical processing (HTAP). Co-founder Lukas Vogel shares insights on the current landscape and challenges faced by enterprises.
In a discussion with Data Center Knowledge, Vogel expressed that there is a general reluctance among enterprises to let AI agents access operational systems directly. "I don't know anyone who feels comfortable doing that right now," he noted, emphasizing the lack of established standards around these interactions. Many organizations prefer to keep strict limits on agent capabilities, often allowing only read operations, to safeguard their databases. This conservative approach underscores a broad desire for agents that can perform additional tasks, while the current environment feels chaotic and undefined in terms of governance.
When asked about the implications of transitioning agents from read-only systems to those capable of executing actions, Vogel highlighted a significant shift in how developers think. Historically, permission checks were conducted at the application layer, allowing unrestricted database access if certain conditions were met. However, as agents begin crafting their own queries, it becomes essential to enforce permissions at the database level, aligning access controls with the data itself.
Vogel made it clear that relying solely on prompts is inadequate for maintaining necessary business rules, as databases inherently provide these controls. He referenced the outdated security models that sometimes rely on verbal assurances, such as trusting an AI not to delete tables. The traditional security mechanisms, such as role-based access control and row-level security, should be integrated into database management practices to maintain effective governance in the age of AI.
Many organizations utilize APIs between AI systems and databases to manage interactions, but Vogel argues that this method can become restrictive. While it works for straightforward tasks, allowing agents greater autonomy means they must generate their own queries and determine their own approaches, all while remaining within established safety boundaries. He believes that redefining permissions at the database level enables agents to function more flexibly without the confines of predefined APIs.
Vogel clarified that enterprises are particularly concerned about failures in sensitive operations, like customer service systems. Businesses increasingly want AI agents to handle tasks such as processing refunds, but the unpredictability of AI behavior adds risk. Organizations can choose to limit agent capabilities entirely, accept some risks, or establish robust boundaries directly in the database to manage actions based on predefined conditions. For example, rules can restrict an agent’s ability to issue rebates only within specific limits, ensuring they operate safely within set guidelines.
He concluded that the need to enforce permissions at the data layer is not a new problem. Role and row-based access controls have been around for decades. However, the way developers engage with databases has changed, leading to a lapse in proactive database programming as operations moved outside these systems. With the increasing amount of data, shifting processing back to databases is becoming a more efficient approach.
CedarDB positions itself at the forefront of this evolution. The company leverages a completely new architecture that takes advantage of modern hardware improvements, distancing itself from the limitations imposed by legacy systems. By being developed as part of a university research project, CedarDB was able to fundamentally rethink system architecture prior to commercial application.
Ultimately, Vogel asserts that if agents are allowed to write SQL, then the responsibility for enforcing permissions must also reside within the database. This alignment is essential to prevent mismatches between the layers where actions are generated and where permissions are applied, ensuring a more coherent and secure operational structure as businesses embrace AI advancements.
