SQL security glossary for AI agents

AST (abstract syntax tree): The tree representation of an SQL statement, with a node for each part: the operation, the tables, the columns, the WHERE. Vericto evaluates its rules on the AST, not on the query text. More →
SQL firewall: A control that sits between whoever sends SQL and the database and decides, statement by statement, whether it runs. More →
Deterministic evaluation: A decision that depends only on the statement and the rules, with no statistical model or LLM involved: the same statement with the same rules always gets the same decision. More →
DELETE without WHERE: A DELETE that filters no rows and empties the whole table. Together with UPDATE without WHERE, DROP and TRUNCATE, it is among the critical rules Vericto blocks by default. More →
DDL: The statements that change the structure of the database, such as CREATE, ALTER and DROP. More →
Dialect: The SQL variant of each engine. Vericto evaluates PostgreSQL, MySQL, Oracle and SQL Server; the TCP proxy speaks the PostgreSQL and MySQL protocols. More →
Severity and action: Severity says how dangerous a statement is and belongs to the rule. The action (BLOCK, FLAG or MONITOR) says what Vericto does, and the workspace policy decides it. More →
Decision: The result of evaluating a query: ALLOWED, FLAGGED, MONITORED, BLOCKED or PARSE_ERROR. Only BLOCKED keeps it from reaching the database. More →
Observe mode: A period in which every BLOCK action is downgraded to FLAG: nothing is blocked and the dashboard shows what would have been. It does not protect the database; it is for calibrating the rules. More →
Fail-open and fail-closed: What Vericto does with a query it cannot parse. By default it lets it through and logs it (fail-open); with fail-closed, it blocks it. More →
Sensitive column: A column tagged because it holds personal or payment data. Every query that reads it is blocked, flagged or gets the masked value back, depending on the column's policy. More →
Data masking: Rewriting the query so it returns a hidden version of the value, for example a***@example.com, instead of the data. Vericto masks on PostgreSQL and MySQL. More →
Agent allowlist: The tables and columns a specific agent may use in a database, read-only or read-write. Everything else is denied for that identity. More →
MCP (Model Context Protocol): A protocol for AI agents to use external tools. Vericto exposes check_sql over MCP so that a coding agent checks the SQL while it writes it. More →
check_sql: Vericto's MCP tool: it takes the SQL and the dialect and returns the decision for each statement, with the suggested fix when it is blocked. More →
Text-to-SQL: A system in which an LLM translates a natural-language question into SQL and runs it. It is one of the cases in which a destructive statement can reach production without anyone reviewing it. More →
TCP proxy: The component installed between the application and the database that speaks its network protocol. It is the only mode in which Vericto sits in the path of the query and can stop it from running. More →
Rule simulator: It evaluates a rule change against the workspace's real traffic and shows which decisions would change, before you apply it. More →
Audit trail: The record of every Vericto decision, with the rule that triggered it. Exports are signed with Ed25519 and can be verified. More →
SARIF: A standard format for static analysis results. Vericto's CLI generates it so that GitHub shows the findings on the pull request. More →
Least privilege: Giving each user, application or agent only the permissions it needs. It is the first line; Vericto complements it with rules on the statement. More →

SQL security glossary

Try it on your own SQL