Limit what a successful injection can do
An agent with database access can receive instructions injected into any text it reads: a ticket, an email, a row. Vericto does not see the prompt, only the SQL, so it does not try to detect the injection. It limits its reach: the agent only uses the tables and columns you gave it.
The model
- A policy belongs to an identity on a database and denies by default. Each entry is a table, its columns (all or a list) and the access:
readorread_write. - observe: what falls outside the allowlist is flagged and never blocked. A new policy starts this way.
- enforce: it is blocked, with rule VERICTO-087.
- DDL and statements that change the identity or name resolution (
SET ROLE,SET search_path,USE) are always denied to an identity with a policy.
What counts as access
Every column the statement mentions: the projection, WHERE, JOIN, GROUP BY, ORDER BY, subqueries, CTEs, RETURNING and the columns INSERT and UPDATE write. A filter counts because it lets the agent probe values. Every table mentioned needs its entry, and writing needs read_write on each target table.
Together with sensitive columns
A blocked or masked column stays blocked or masked even if it is in the allowlist: a block tag always wins, and an allowed column tagged mask comes back masked.
The identity in each mode
In the runtime API, the CLI, the validation API and MCP, the identity is the API key making the call: use one key per agent. In the TCP proxy, it is the session's database user. The allowlist is a control in the TCP proxy and a decision in the other modes.
Simulate before you enforce
Simulate replays that identity's queries on that database from the last 7 days (up to 2,000) against the draft, without saving it, and says how many it would have blocked. Nothing is sent to your database. The recommended order: create the policy in observe, let the agent work, simulate, adjust and switch to enforce.
Limits
- It is defence in depth: your database's roles, grants and row-level security remain the first line.
- Vericto does not know your schema: a view, function or trigger over a table is not resolved to that table, and function calls are not restricted here.
- If you rename a table or column, the allowlist does not update itself.
Available on the Team and Enterprise plans. Policies are enforced in the TCP proxy and in the Vericto evaluator.