Honeytokens: decoy tables that trip when an agent touches them

A well-behaved agent has no reason to read a table nobody told it about. That makes an untouched table a useful tripwire.

Mark any relation as a honeytoken and PgBeam enforces the trip in band: an agent that references it is stopped at the proxy and the event lands in your audit log and webhooks. You find out from the alert, not from the audit trail three weeks later.

This is worth pointing at the tables an exfiltration attempt would go looking for first, the ones with names like customer_cards or api_keys_backup. Nothing legitimate reads them, so a hit is unambiguous.