目录
Giving a Large Language Model direct SQL execution access is the shortest path to cross-tenant data leaks or production database outages. Engineering teams that wired raw Text-to-SQL into early AI assistants quickly ran into prompt injection, unindexed cross-joins, and bypassed application-level RBAC. Implementing a Model Context Protocol (MCP) gateway replaces arbitrary query generation with deterministic, Zod-validated tools.
The Three Failure Modes of Raw Text-to-SQL
- Bypassed Application RBAC: Tenant isolation usually lives in service code, not database roles.
- Accidental Denial of Service: Unbounded joins across multi-million-row tables saturate CPU.
- Schema & PII Exposure: Feeding raw table schemas and unredacted customer fields into model context expands the attack surface.
Enforcing AGENT_SURFACE and AGENT_NEVER Boundaries
In Sajjad Studio's Agent API, every Payload CMS collection is explicitly classified into AGENT_SURFACE (field-level allow-list + automatic PII redaction), AGENT_NEVER (keys, sessions, encrypted messages, financial ledgers), or AGENT_DEFERRED. Combined with SHA-256 hashed keys (ak_<prefix>_<secret>) and monthly unit metering, agents only ever see the tools their scope unlocks.
Explore our custom MCP and AI architecture offerings on the Sajjad Studio services page.