RecommendAgentPolicy

Derives the tightest policy that would still pass every statement this agent credential has legitimately run, using its recorded audit history over a lookback window (default 30 days). The candidate's table allowlist is the union of relations actually referenced, its statement-kind allow set is the observed set, it downgrades to read-only when no writes were seen, and its max_rows ceiling comes from an observed high-percentile row count. The candidate is proven safe by replaying it through the data plane's own policy engine against the same history: a good recommendation has replay.summary.newly_blocked == 0. This endpoint is advisory only. It reads the audit log, never connects to the upstream database, and never creates, updates, or mutates any policy or credential; the operator loads the candidate into the editor and saves it themselves.

Usage

result, err := client.Policies.RecommendAgentPolicy(ctx, "prj_xxx", "agt_xxx", pgbeam.PolicyRecommendationInput{

  })

Parameters

Response

(*pgbeam.PolicyRecommendation, error): the recommended candidate policy and its replay proof.

Example

import pgbeam "go.pgbeam.com/sdk"

client := pgbeam.NewClient(&pgbeam.ClientOptions{
  APIKey: "pgb_your_api_key",
})

result, err := client.Policies.RecommendAgentPolicy(ctx, "prj_xxx", "agt_xxx", pgbeam.PolicyRecommendationInput{
    LookbackDays: 30,
    Limit: 200,
  })
if err != nil {
  log.Fatal(err)
}
fmt.Println(result)

Errors