A prompt is not a permission system

It is tempting to add “only show my territory” to the system prompt and move on. I understand the appeal. But a prompt is a suggestion, and the model can ignore it, forget it, or misread it on a hard question. A better setup parses the generated SQL and rewrites it before anything runs, so the rules live in code that the model cannot talk its way around. In the benchmark behind this work, the most common fix across 900 test queries was adding a row filter to the WHERE clause (285 times). Column masking came next (240), followed by scope restriction (165).

Yes or no is rarely the real answer

Most real questions don’t fit neatly into allow or deny. In the same 900 queries, 40% could run unchanged. Another 20% needed a row filter, 15% needed column masking, and 11.7% needed a join rewrite. Around 6.7% went to a human reviewer, and another 6.7% were blocked. Most people still got a useful answer. It was just a safer one, and I think that trade is the right one to make.

Check before it runs, and keep the account small

Validate every query before it executes. Reject SELECT *, pulls that cross scope boundaries, oversized result sets, and risky joins. Then send everything through a gateway that connects with a narrow database account. That way, a prompt injection or a bad generation can’t walk around your rules, even when the model gets creative.