Full read, gated write - Zero One Labs

Two connection strings make a database safe for an agent. What is the equivalent for everything else it touches?

The instinct is to narrow what an agent can see. It is the wrong instinct. An agent that cannot read a table cannot answer questions about it, and the result looks like stupidity rather than like a permission error.

So we give it everything to read and nothing to write. All exploration runs through a read-only replica. Writes run through a second connection that only fires on human approval.

That guarantee is structural. It does not depend on the model behaving, on a prompt holding, or on a classifier catching the right verb. The agent cannot alter data while it reasons, because the connection it reasons through cannot.

We do not have the same guarantee anywhere else. Filesystems, outbound HTTP, third-party APIs, sending mail: each needs its own split, and most do not offer one at the infrastructure level. Our current suspicion is that SQL is unusually lucky here, and that every other capability needs a gate built by hand. If that is true, a system's real safety budget is how many gates it can afford.