SQLGuard field notes https://sqlguard.io/blog Engineering notes on permission before production writes. en-us Sat, 01 Aug 2026 15:54:00 GMT Connection strings are not change control https://sqlguard.io/blog/connection-string-is-not-change-control.html https://sqlguard.io/blog/connection-string-is-not-change-control.html Sat, 01 Aug 2026 15:54:00 GMT hello@sqlguard.io (SQLGuard) Credentials open the door. Receipts govern the write. Human-in-the-loop is not a receipt https://sqlguard.io/blog/human-in-the-loop-is-not-a-receipt.html https://sqlguard.io/blog/human-in-the-loop-is-not-a-receipt.html Sat, 01 Aug 2026 15:53:00 GMT hello@sqlguard.io (SQLGuard) A chat yes is a moment. A statement-bound receipt is evidence. Dry-run is not permission https://sqlguard.io/blog/dry-run-is-not-permission.html https://sqlguard.io/blog/dry-run-is-not-permission.html Sat, 01 Aug 2026 15:52:00 GMT hello@sqlguard.io (SQLGuard) Sandbox and EXPLAIN are taste. Production execute still needs authorize. Audit logs are after the write https://sqlguard.io/blog/audit-logs-are-after-the-write.html https://sqlguard.io/blog/audit-logs-are-after-the-write.html Sat, 01 Aug 2026 15:51:00 GMT hello@sqlguard.io (SQLGuard) Logs explain what ran. Receipts decide whether it was allowed. RLS is not statement authorize https://sqlguard.io/blog/rls-is-not-statement-authorize.html https://sqlguard.io/blog/rls-is-not-statement-authorize.html Sat, 01 Aug 2026 15:50:00 GMT hello@sqlguard.io (SQLGuard) Tenant isolation and statement permission solve different failures. CI gate is not production authorize https://sqlguard.io/blog/ci-gate-is-not-production-authorize.html https://sqlguard.io/blog/ci-gate-is-not-production-authorize.html Sat, 01 Aug 2026 15:48:00 GMT hello@sqlguard.io (SQLGuard) A green PR check is a rehearsal. Runtime still needs PASS + verify. Readonly flags are not receipts https://sqlguard.io/blog/readonly-flag-is-not-a-receipt.html https://sqlguard.io/blog/readonly-flag-is-not-a-receipt.html Sat, 01 Aug 2026 15:47:00 GMT hello@sqlguard.io (SQLGuard) mode=readonly is a kill switch. The intentional write still needs a decision. Which agent_id authorized this? https://sqlguard.io/blog/which-agent-authorized-this.html https://sqlguard.io/blog/which-agent-authorized-this.html Sat, 01 Aug 2026 15:46:00 GMT hello@sqlguard.io (SQLGuard) The pager question after an agent mutates production. Access mode is not authorize https://sqlguard.io/blog/access-mode-is-not-authorize.html https://sqlguard.io/blog/access-mode-is-not-authorize.html Sat, 01 Aug 2026 15:45:00 GMT hello@sqlguard.io (SQLGuard) Unrestricted / write modes set capability. Permission binds one statement. Client confirm does not travel https://sqlguard.io/blog/client-confirm-does-not-travel.html https://sqlguard.io/blog/client-confirm-does-not-travel.html Sat, 01 Aug 2026 04:10:00 GMT hello@sqlguard.io (SQLGuard) Local [y/N] helps one client. Other hosts need a statement-bound receipt. Why Probe is free https://sqlguard.io/blog/why-probe-is-free.html https://sqlguard.io/blog/why-probe-is-free.html Fri, 31 Jul 2026 18:40:00 GMT hello@sqlguard.io (SQLGuard) Risk guidance is useful before a write, but guidance is not permission. Authorize is not lint https://sqlguard.io/blog/authorize-not-lint.html https://sqlguard.io/blog/authorize-not-lint.html Fri, 31 Jul 2026 18:36:00 GMT hello@sqlguard.io (SQLGuard) Lint inspects a statement. A receipt answers who permitted the write.