Database Access

Connect your agents to external databases with granular permissions, query limits, and full audit logging.

Overview

How It Works

1. Add a connection — configure host, port, credentials, or paste a connection string. The connection is tested before saving.
2. Grant agent access — select an agent and assign permissions (read, write, delete, schema, execute) with query limits.
3. Agents query databases — agents use their granted connections with enforced permissions and limits.
4. Everything is logged — every query, its result, latency, and status appear in the audit log.

Key Concepts

Three Tabs

Connection Status

Connections Tab

Displays all database connections as cards showing type, name, host/port/database, status, and last error (if any).

Adding a Connection

1. Click "+ Add Connection"
2. Step 1: Choose database type — select from the visual picker (organized by category).
3. Step 2: Enter connection details — either paste a full connection string or fill in individual fields (host, port, database, username, password).
4. Test Connection — validates connectivity and shows latency.
5. Add Connection — saves the connection (auto-tests first if not already tested).

Connection Card Actions

• Test — verify the connection is reachable and measure latency.
• Grant Access — open the grant modal to give an agent access.
• Edit — modify connection name, host, port, database, or SSL settings.
• Delete — remove the connection and all associated agent access grants.

Supported Databases

Relational (SQL)

Cloud-Native SQL

NoSQL / Key-Value

Agent Access Tab

Shows a card for each agent that has database access. Each card lists:

• Agent name and avatar
• Number of databases the agent can access
• For each database: connection name, type icon, and permission badges
• Revoke button — immediately removes access for that agent on that database

Permission Model

When granting an agent access to a database, you select which operations they can perform:

Query Limits & Safety

Each agent access grant includes configurable safety limits:

Additional Safety Options

• Blocked Tables — comma-separated list of tables the agent cannot access (e.g., users_secrets, payment_tokens).
• Log ALL queries — by default, only writes/deletes are logged. Enable this to also log read queries.
• Require human approval — write and delete operations must be approved by a human before executing.

Audit Log Tab

Every database query executed by an agent is logged with full details:

Filtering

• Search — full-text search across queries, agents, databases, and errors.
• Operation filter — filter by read, write, delete, schema, or execute.
• Status filter — show only successful or failed queries.
• Agent filter — filter by specific agent (auto-populated from log data).

Expanded Detail

Click any row to expand and see:

• Full SQL query (formatted, scrollable)
• Agent ID and Connection ID
• Exact rows affected and execution time
• IP address
• Error message (for failed queries)

Configuration & Setup

API Endpoints

Grant Access Request

POST /database/connections/:id/agents
{
  "agentId": "agent-123",
  "permissions": ["read", "write"],
  "queryLimits": {
    "maxRowsRead": 10000,
    "maxRowsWrite": 1000,
    "maxRowsDelete": 100
  },
  "schemaAccess": {
    "blockedTables": ["users_secrets", "payment_tokens"]
  },
  "logAllQueries": true,
  "requireApproval": false
}

Connection Create Request

// Using connection string
POST /database/connections
{
  "type": "postgresql",
  "name": "Production DB",
  "connectionString": "postgresql://user:pass@host:5432/mydb",
  "description": "Main production database"
}

// Using individual fields
POST /database/connections
{
  "type": "mysql",
  "name": "Analytics DB",
  "host": "analytics.example.com",
  "port": 3306,
  "database": "analytics",
  "username": "reader",
  "password": "...",
  "ssl": true,
  "description": "Read-only analytics database"
}

Best Practices

Troubleshooting

Related Pages