Agent permissions are harder to bypass when they sit in the database

Jeff Smith has spent 25 years building database tools at Oracle. On the AI Engineer show, he argued that an AI agent's data permissions should be enforced in the database. Those permissions should also follow the identity of the person asking. Controls that live only in the agent's tools, he said, can be bypassed.

What was said

Smith said the best place to enforce security for a database is at the database. His worry was a tool that carries the only guard. He asked: "If you build security only into your tools, what happens when a zealous engineer decides to go pick up another tool and point it at your database?" His answer was that they go straight in.

Read-only access is not enough, he said. An agent that can only read may still read data the person asking should not see.

His fix works in steps. The agent does not use a database login. The request goes through the company's single sign-on, which returns the person's scopes and roles. The database holds rules for each role. Smith's example was an HR manager, who may see everyone's salary. People outside that group may not.

When the agent's query runs, Smith said, "the database dynamically strips data from the result set before it comes back down to the agent." Oracle calls this deep data security.

Why it matters

Our reading: a guard inside a tool sits where any new tool can skip it. A guard in the database is harder to skip, because every tool must reach the data through it. That holds only if the database sees the real user's identity. If an agent leaks a row, the blame lands on whoever put the guard in the wrong layer.

Smith did not say who pays for a leak. He raised leaked personal data and a hearing before Congress as the risk. The company may pay first, and the people whose records were exposed may pay next.

Before you sign off on an agent, ask whether the database sees the real user's identity. Ask what happens to the rules when someone adds a new tool.

The other side

Smith works for Oracle and was describing Oracle's product. He gave no figures on how often tool-level controls are bypassed. He also hedged, saying that with security at the database layer you are fine more often than not. That is not a guarantee.

He said he would keep agents out of production altogether if he could. Identity-based filtering is only as good as the roles someone codes. The talk did not say how teams keep those rules correct as the organisation changes.