1 line
3.0 KiB
Plaintext
1 line
3.0 KiB
Plaintext
Project Sentinel: SQL & Analytics ProfileVersion: 3.0.0-EnterpriseModule: 39-Lang-SQLMaps to: examples/sql/Scope: Active enforcement of Query Safety, dbt project standards, SQL Injection prevention, and Schema Migration integrity.1. The Query FirewallWhen an Agent acts as a Data Analyst or Engineer, it wields the power to wipe tables. Sentinel wraps the database driver to act as a proxy.1.1 Destructive Command BlockadeRule: No DDL/DML outside of migrations.Enforcement:Sentinel parses every SQL statement before execution.Keywords: DROP, TRUNCATE, DELETE, ALTER, GRANT.Action: BLOCKED in standard "Query Mode".Exception: Allowed only inside .sql files in the migrations/ directory AND only when running the run_migration tool.1.2 The "Missing Where" GuardThreat: UPDATE users SET active = false; (Forgot the WHERE clause).Enforcement:Sentinel analyzes UPDATE and DELETE statements.If WHERE clause is missing:Action: CRITICAL BLOCK.Message: "Catastrophe Prevention: Unbounded UPDATE/DELETE detected. You must provide a WHERE clause."2. dbt (Data Build Tool) IntegrationFor Analytics Engineering agents, Sentinel enforces dbt standards.2.1 Model MaterializationRule: Don't materialize everything as tables.Enforcement:Sentinel checks dbt_project.yml and model config blocks.If materialized='table' is the default for a staging model:Warning: "Performance Warning: Staging models should be view or ephemeral. Use table only for marts."2.2 Test Coverage (Schema.yml)Rule: Every model must have unique primary keys.Enforcement:When Agent adds a new model dim_users.sql, Sentinel checks schema.yml.Check: Existence of unique and not_null tests on the ID column.Action: Block commit if tests are missing.3. SQL Injection PreventionFor Agents writing application code (Python/Go/TS) that embeds SQL.3.1 Parameterization CheckRule: No string concatenation for SQL.Enforcement:Sentinel Greps for patterns like:Go: fmt.Sprintf("SELECT ... %s", var)Python: f"SELECT ... {var}"TS: `SELECT ... ${var}`Action: BLOCKED.Message: "Security Risk: SQL Injection vulnerability. Use bind parameters ($1, ?, :name)."4. Query Performance (The "Explain" Gate)Rule: No full table scans on large tables.Enforcement:Before executing a SELECT on production/staging:Sentinel runs EXPLAIN (Postgres/MySQL).It checks the cost estimate.Threshold: If cost > 10,000 (configurable):Action: Pause.Message: "Expensive Query Detected (Cost: 45,000). Are you missing an index on created_at? Please optimize or request override."5. Troubleshooting SQL Agents5.1 Common Failure Modes"Ambiguous Column Name":Sentinel Fix: Sentinel parses the error, identifies the duplicate column in the JOIN, and prompts: "Column id exists in both users and orders. Use users.id.""Relation does not exist":Sentinel Fix: Checks the schema cache. If the table exists but in a different schema, suggests: "Did you mean public.users?""Transaction Blocked":Sentinel Fix: Detects long-running idle transaction. Kills the connection and warns the Agent to "Commit or Rollback explicitly." |