Recipes
Wire it up, one policy shape at a time
One page per client and policy shape. The paste-ready config, the policy that goes with it, what the policy refuses, and what it does not cover.
Claude Code
Claude Code, read-only, on named tables
A coding agent needs to read production to answer questions, and must not be able to write or to wander into tables nobody cleared.
Cursor
Cursor, with PII masked in the results
The agent needs rows from a table that has personal data in it, and the personal columns must not reach the model context.
a LangChain SQL agent
A LangChain SQL agent, with a ceiling on what it can pull
An agent writes its own SQL in a loop, and a bad plan or a retry storm can pull far more data than anyone intended.
an agent that needs to write
Let an agent write, in dry-run first
The agent genuinely needs to change data, and nobody is comfortable letting the first version of its UPDATE reach a real table.
a CI agent
A CI agent that can ship migrations, with the dangerous ones held
An agent opens pull requests that contain migrations, and the failure you are worried about is a schema change that locks a table or drops a column in production.
Claude Desktop
Claude Desktop, scoped to the tables you name
Somebody wants to ask questions of the database from the desktop app, and the database has schemas in it that nobody outside the team should be reading.
These assume you have decided. If you have not, the comparisons cover the alternatives and the guides cover the technique with plain Postgres first. Every flag used here is documented in the CLI reference.