Question 1

How does PgBeam enforce what an agent can do?

Accepted Answer

Enforcement happens in the PostgreSQL wire protocol, between the agent and your database. PgBeam parses every statement an agent sends, checks it against the policy attached to that credential (read-only, table and column allowlists, masking, budgets), and only forwards it if it is allowed. Blocked statements never reach your database.

Question 2

Does PgBeam work with my Postgres?

Accepted Answer

Yes. Enforcement is at the wire, not inside the database, so PgBeam works with RDS, Aurora, self-hosted Postgres, or any managed provider. There is no extension to install and no change to your schema.

Question 3

Do I need to change my code?

Accepted Answer

No. The agent gets a scoped connection string or a hosted MCP URL. Every PostgreSQL driver, ORM, and agent framework works unmodified. Your own application keeps using its existing connection untouched.

Question 4

How does PII masking work?

Accepted Answer

You name the columns to protect and choose redact, null, or hash. PgBeam rewrites those values in the result before they leave the wire, so the agent receives masked data it can still join and group on. Your application reads the real values.

Question 5

Can I revoke an agent's access?

Accepted Answer

Yes, instantly. Revoke a single credential or hit the kill-switch to stop one agent or every agent on a project. The next statement is refused. No credential rotation and no database changes required.

Question 6

What is in the audit log?

Accepted Answer

Every statement an agent runs, allowed or blocked, with the decision, reason, rows, bytes, latency, and credential. Filter and export it in the dashboard. Recent entries are queryable in the control plane and archived for retention.

Question 7

What MCP tools does the hosted endpoint expose?

Accepted Answer

query, list_tables, describe_table, and explain. Every call runs through the same policy engine as the connection string, so an agent connected over MCP gets the same guardrails. Paste the URL into Claude Code, Cursor, or any MCP client. No install.

Question 8

What does "Technical Preview" mean?

Accepted Answer

PgBeam is currently in technical preview, which means the platform is available for internal testing and evaluation only. It is not production-ready. Features, APIs, and pricing may change without notice. There are no SLAs, uptime guarantees, or support commitments during this period. Do not rely on PgBeam for production workloads.

Question 9

Is there an SLA or uptime guarantee?

Accepted Answer

No. During the technical preview, PgBeam is provided "as is" with no service level agreement, uptime commitment, or guaranteed response times. The platform may experience unplanned downtime, data loss, or breaking changes. SLAs will be available after general availability (GA).

Question 10

What happens if I exceed my limits?

Accepted Answer

Overage is billed at $0.10 per 1K queries above your daily limit on all plans. Data transfer overage is $0.20/GB on all tiers. No surprises: usage is tracked in your dashboard. Note: pricing is subject to change during the technical preview.

Question 11

Can I switch plans at any time?

Accepted Answer

Yes. Upgrade or downgrade any time from your dashboard. Upgrades take effect immediately. Downgrades take effect at the end of the current billing period.

Question 12

Does the gateway add pooling and caching?

Accepted Answer

Yes. The gateway runs on a globally distributed wire-protocol proxy, so agent traffic gets connection pooling (which absorbs the connections agents leak) and optional query caching (which absorbs the questions they re-ask) at no extra setup.

Question 13

Can I self-host PgBeam?

Accepted Answer

PgBeam is a managed service. Self-hosting is not currently supported.

Simple, transparent pricing

Starter

Pro

Scale

Need custom limits?

Frequently Asked Questions

Get started in 30 seconds