What each one decides
| Situation | With roles and GRANTs | With Vericto in front |
|---|---|---|
| A DELETE or UPDATE without WHERE | It runs if the role has the DELETE or UPDATE privilege on the table. | Blocked by default, before it reaches the database. |
| DROP or TRUNCATE | It runs if the role owns the table or holds the corresponding privilege. | Blocked by default. |
| Reading a column with personal data | Column privileges or views, to be maintained for each role. | The column is tagged as sensitive: the query is blocked, flagged or gets the masked value back (Postgres and MySQL). |
| Limiting an agent to certain tables | One role per agent, with its GRANTs. | An allowlist per agent, of tables and columns, evaluated on the AST. |
| Knowing what the agent tried to run | The database logs, if they are enabled. | Every decision in the audit trail, with the rule and the AST node; signed exports. |
| Testing a policy change | It is tested in another environment. | The simulator evaluates it against real traffic, and observe mode flags without blocking. |
Why a read-only role is not always enough
Many agents need to write: create a record, update a status, run a migration. Read-only access leaves them unable to do their job; write access also gives them the destructive statement. The database checks permissions, not the shape of the statement: UPDATE orders SET status = 'paid' WHERE id = 42 and the same UPDATE without WHERE need exactly the same privilege.
And even read-only, a SELECT email, card_number FROM customers puts personal and payment data into an LLM context.
What Vericto does not replace
- Least-privilege roles, column privileges, views and row-level security remain the first line. Vericto is defense in depth.
- Only the TCP proxy sits between the query and the database. The API, the CLI and MCP report the verdict; for it to be a control, the agent must reach the data through the proxy.
- By default, a query that cannot be parsed goes through and is logged (fail-open); the workspace can switch to fail-closed.
How to use them together
- One role per application or agent, with the minimum privileges it needs.
- Vericto in front, through the proxy, for the rules on the statement: missing WHERE, DROP, TRUNCATE, sensitive columns and the agent's allowlist.
- Observe mode first, to see what would be blocked before blocking it.