Documentation / Security

Secure database

You decide, connection by connection, what the agent can do in your database. Nothing writes without your approval.

Each connection in the database client has its own access policy for the agent. The IDE enforces it on every statement; the agent cannot change it.

The three levels

They are configured in the connection dialog, in the Agent access section.

Level What the agent sees and can do
No access The agent does not see this connection.
Queries only (default) Only SELECT, with a row limit.
Super permissions Changes you choose, always with your approval.

Super permissions

With Super permissions you check which kinds of statement are enabled:

Checkbox Statements
Modify data INSERT, UPDATE, DELETE, MERGE
Change structure CREATE, ALTER, DROP, TRUNCATE
Run code PL/SQL blocks and procedures

A statement of an unchecked kind is rejected: “This connection's super permissions don't include this kind of statement.”

Every statement is shown to you for approval and never runs in unattended mode. If the connection is marked as read-only, that overrides any agent permission.

How a write is approved

  1. The agent proposes the statement with the yuli_db_execute tool.
  2. Yuli checks that the connection has Super permissions for that kind of statement.
  3. The “Run on the «name» database” card appears with the full statement.
  4. You approve or reject it. Without your approval, nothing runs.

The same applies in Subscription mode: if Claude Code, Kiro, Codex or Antigravity call yuli_db_execute, the card appears in Yuli.

Limits on the agent's queries

Limit Value
Maximum time per query 45 seconds
Rows per query 100 by default, up to 1,000 (Max rows per query)
Expensive execution plans A query is rejected when its plan estimates scanning more than 2 million rows under a sort, aggregation, join or DISTINCT.

Yuli wraps every query with ROWNUM, TOP or LIMIT depending on the engine, so the row limit is always enforced.

The SQL console you use has its own limits: 500 rows by default, up to 100,000.

No shortcuts through the terminal

The agent cannot use command-line database clients (sqlplus, sqlcl, sqlcmd, bcp, sqlite3, psql, mysql, mariadb, mongo, mongosh, isql, db2, impdp, expdp, rman and similar). That way, nobody bypasses the access policy.

Passwords

Each connection's password is stored in the system keychain, never in the project. The agent's access policy is stored in your user configuration, outside the project, so a repository cannot grant itself permissions.

Best practices

  • Keep Queries only on connections to shared environments.
  • Use Super permissions only on your local or development database, and only with the kinds of statement you need.
  • Mark connections to production as read-only.
  • To explain or debug PL/SQL code, the agent does not need to write: reading the schema and the source code is enough.