DROP is destructive, /admin/** is off limits, the salaries table is not yours. They are useless against intent you could not enumerate in advance — which is most of what an agent does.
Agentic access closes that gap. The AI Analyzer sits in front of the resource, classifies the statement, and the risk it reports selects a tool.
This runs entirely in the Sidecar. The Sidecar holds the provider credential and reads one YAML file, and no statement is sent anywhere you did not configure.
The tools
Anai_analysis rule maps each risk level the model can report to a tool.
A risk level you do not name defaults to
allow, so you opt into blocking a tier by writing it down.
Guardrails and Data Masking reach the same request from the other direction. Local rules run before the analyzer, so a DELETE a type: operation rule already refuses never costs a model call; masking runs on the response regardless of which path the request took.
Configuration
Two pieces: ananalyzer block that says which model to call, and an ai_analysis rule that says when to call it and what to do with the answer.
config.yaml
What leaves the process
send decides how much of a statement the provider sees:
The credential is always a path (
credentials_file), never inline, and the file must be 0600 or stricter.
HTTP listeners must opt into capture
The HTTP codec captures nothing by default, so anai_analysis rule on an HTTP listener without capture_body is refused at startup:
authorization, cookie and proxy-authorization cannot be allowlisted as captured headers.
Cost controls
This is the only evaluator that leaves the process, costs money per statement and can take a second. An ORM issues the same statement shape thousands of times in one session, so read this before enabling it anywhere real.1
trigger narrows what is classified
Only statements naming these operations, tables or resources are sent. Everything else allows for free. An empty trigger is a startup error — the failure mode of the opposite default is an invoice.
2
The cache keys on the statement shape
WHERE id = 1 and WHERE id = 2 are one verdict: literals are stripped from SQL, and HTTP resources are already normalized by the codec. This is also more correct than caching on bytes — the shape is what is risky, not the parameter.3
max_calls is a backstop
A process-lifetime budget. Past it, statements fall through to the local rules, the same outcome as a listener with no analyzer.
It fails open, and everything else fails closed
The analyzer defaults tofail_open: true. It depends on a third-party API, and a provider outage that closes every database connection in your fleet is a worse incident than the one it prevents. The rules engine and the policy endpoint fail closed, as they should — they depend on nothing.
Decide which you want per environment, and know that fail_open: false makes your model provider a hard dependency of your database.
Next
AI Analyzer Reference
Every field, the gate phase, prompt precedence and the full findings vocabulary.
Direct Access
The deterministic path, and when to prefer it.
Guardrails
The rules that run before the analyzer and keep it cheap.
Data Masking
Rewrite sensitive values on the way back.