SQLGuard

Field note 09

Audit logs are after the write.

A complete statement log tells you what happened. It does not stop the statement, and it does not prove anyone intended it.

Teams often answer agent risk with more logging: pgaudit, proxy logs, warehouse trails. Useful for forensics. Late for control.

By the time the log line exists, the row is already gone or mutated. The pager then reconstructs intent from chat history — which agents do not retain reliably.

Decision before execute

An Authorization Receipt flips the order: decide, sign, verify, then run. The log becomes confirmation of a prior decision, not the only evidence you have.

Keep the audit trail. Do not confuse it with permission.

If this is your write path

Challenge · Gateway · honesty on Trust.