Gate Database Writes From an AI Agent

AI Agent写数据库，先过人工审批这一关！核心亮点是，这篇技术文章提出了一种简单却关键的安全机制：当AI Agent准备执行INSERT、UPDATE、DELETE这类会改变数据的SQL操作时，必须经过人类批准才能落地到生产数据库。通俗讲，文本转SQL的AI虽然能帮你自动写查询语句，但这些语句本质上是AI对意图的猜测——一个漏掉的WHERE条件、一个错误的关联，就可能把本该改5行的操作变成改5000行。所以文章明确画了条线：SELECT查询（只读）无需干预，但写入和修改数据就必须过一道门。通过集成Impri MCP服务器，开发者可以轻松把这个审批逻辑嵌入到Claude Code等Agent工具中，让AI自己生成查询草案，但最终执行权交给人类。对普通用户来说，这意味着未来用AI管理数据时，类似“误删全库”的大事故会被有效拦截；对开发者和企业而言，这项实践让AI Agent在实生产环境的应用不再裸奔，安全性与可用性兼得了。

A text-to-SQL agent's query is a guess. Gate database writes from an AI agent — INSERT, UPDATE, DELETE — behind human approval before they touch production. <h2> The shape of the problem </h2> Text-to-SQL agents are useful precisely because they turn "mark these five overdue invoices as written off" into a working query without anyone hand-writing SQL. That's also what makes them dangerous: the query the model generates is a guess at intent, and a guess that's slightly too broad — a missing <code>WHERE</code> clause, a join that fans out rows, a <code>LIKE</code> pattern that matches more than intended — turns into a write that touches thousands of rows instead of five. Read-only queries (<code>SELECT</code>) don't need this. Writes do. The dividing line for where to put the gate is simple: <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Query type</th> <th>Gate before executing?</th> </tr> </thead> <tbody> <tr> <td><code>SELECT</code></td> <td>No — read access is not a side effect Impri needs to mediate</td> </tr> <tr> <td> <code>INSERT</code> / <code>UPDATE</code> </td> <td>Yes — the row didn't exist / didn't look like that before</td> </tr> <tr> <td> <code>DELETE</code> / <code>TRUNCATE</code> </td> <td>Yes, and treat as high-severity — see <a href="https://impri.dev/docs/human-approval-before-an-agent-deletes-data" rel="noopener noreferrer">gating deletes specifically</a> </td> </tr> <tr> <td> <code>DDL</code> (<code>ALTER TABLE</code>, etc.)</td> <td>Yes — schema changes are rarely something an agent should self-approve</td> </tr> </tbody> </table></div> <h2> Wiring the gate with the Impri MCP server </h2> If the agent runs inside Claude Code, Claude Desktop, or another MCP client, the cleanest integration point is the query-execution tool itself — not the SQL-generation step. The model can draft as many candidate queries as it wants; only the executor is gated. Add the Impri MCP server to the agent's config: <div class="highlight js-code-highlight"> <pre class="highlight json"><code>{ "mcpServers": { "impri": { "command": "npx", "args": ["@impri/mcp"], "env": { "IMPRI_API_KEY": "im_your_key_here", "IMPRI_BASE_URL": "https://api.impri.dev" } } } } </code></pre> </div> Then the agent's write-executor tool is described (in its own tool definition) as requiring an approved Impri action before it will run. The flow the agent follows, driven by MCP tool calls: <div class="highlight js-code-highlight"> <pre class="highlight typescript"><code>import { execute } from "./db"<span