[throwaway115]

What guarantees do you offer with query security if I turn this over to an end user? How do I keep them only accessing their own data?

[aazo11]

We recommend users leverage row-level security features built into modern RDBMS so the query results only return data for a given user.

You can read more on how to do that on Postgres here https://www.2ndquadrant.com/en/blog/application-users-vs-row...

[throwaway115]

Where do you recommend this? It sounds dangerous for databases that do not implement RLS, like Mysql, MariaDb, Sqlite. I think you should highlight that very clearly somewhere.

[freeone3000]

Any number of database namespacing techniques already present in postgresql can prevent this. Link the user sign-on to a DB user and you’re gold.

[throwaway115]

What? How does that ensure user 123 only generates LLM queries that constrain on rows where user=123?

[aazo11]

As I wrote on the original thread, we recommend using the RDBMS row-level security features.

This blog discusses how to do that on Postgres

https://www.2ndquadrant.com/en/blog/application-users-vs-row...

[altdataseller]

Way way too complicated. I thought this tool was suppsed to make my life easier

[saigal]

is there an easier way?

[altdataseller]

Yes write SQL