DE//AGENT
Explore
Tutorial Lesson 6 of 10 · The Agentic Series community beginner

Keep an agent read-only until a human approves

Coding agents can do real data-engineering work, but can also ship a schema change or drop a table. Walk the Agent-in-the-Loop Review pattern: separate read/recommend from write/execute, put a human gate before anything irreversible, and encode the policy as hooks.

At a glance

When Any agent touching production data; Regulated environments
Where Agentic Data Engineering
Why Trust must be earned per action — the pattern keeps agent velocity while bounding the blast radius to what a human approved.

Learning objectives

  • Separate agent read/recommend from write/execute
  • Encode the safety policy as hooks
  • Keep a human gate on anything irreversible

What you need

  • An agent working against a real data repository
  • Read-only credentials for the agent
  • The destructive SQL guard and prod write confirmation hooks available

Steps

  1. Separate read/recommend from write/execute. (from pattern-agent-in-the-loop-review )
  2. Constrain the agent with read-only credentials plus MCP servers limited to the needed tools. (from pattern-agent-in-the-loop-review )
  3. Encode the safety policy as hooks (destructive SQL guard, prod write confirmation). (from pattern-agent-in-the-loop-review )
  4. Keep a human in the loop for anything irreversible. (from pattern-agent-in-the-loop-review )
  5. Test the policy — `DROP TABLE prod.orders` from an agent is denied and surfaced for confirmation. (from hook-destructive-sql-guard )

Check yourself

  • A write against a production target is suspended pending a human 'approve once' token scoped to the single call.
  • A destructive statement is denied by default, and a DELETE/UPDATE without a WHERE clause is always denied.

Worked example

Separate read/recommend from write/execute — from pattern-agent-in-the-loop-review 

read ─▶ recommend ─▶ human approves ─▶ execute (scoped, logged)

Constrain the agent with read-only credentials plus MCP servers limited to the
needed tools. Encode the safety policy as hooks (destructive SQL guard, prod
write confirmation), and keep a human in the loop for anything irreversible.

Destructive SQL guard — what gets denied — from hook-destructive-sql-guard 

Destructive statements are denied by default; a DELETE/UPDATE without a WHERE
clause is always denied. Statements on a non-production target can be allowed
with a `--allow-destructive` flag that requires a human confirmation token.

Example: `DROP TABLE prod.orders` from an agent is denied and surfaced for confirmation.

Prod write confirmation — approve once, per call — from hook-prod-write-confirm 

Classify the tool target as production by connection string, project or
catalogue tag. Any write-class tool against a production target is suspended
and surfaced for a human "approve once" token scoped to the single call.

Example: an agent asked to run a MERGE on prod.sales is suspended pending approval.

Sourced from

Security scan

Last sweep 2026-10-24: 0 finding(s), 0 marked as examples.

Common gotchas

  • Blast radius can be production — an agent with write credentials is one prompt away from a drop.
  • The human gate adds friction; it requires a real permission model, not a convention.
  • A DELETE/UPDATE without a WHERE clause is always denied — there is no flag for it.

Production considerations

  • Grant read-only credentials by default; write only through the scoped, logged execute path.
  • Encode the safety policy as hooks so it holds even when the agent is prompted otherwise.

Diagram

agent
   |
   |- read tools --> analysis --> proposal
   |
   |- proposal --> human gate --> approved --> scoped write (logged)
   |                  > rejected --> no write
   |
   |- hooks --> destructive SQL guard + prod write confirm --> policy enforced

Registry stats

Verification community · Oct 21, 2026
Completeness 81
Trust multiplier ×1.25
Composite 34.15 · adequate
Freshness 3 days since last source check
Difficulty beginner
Version 0.1.0
License CC-BY-4.0
Security flags none