38% of analyst queries return empty results due to hidden permission failures in text-to-SQL

A structural analysis of text-to-SQL systems has found that analysts receive silent, misleading 'no records found' responses 38.5% of the time when the data exists but is restricted by row-level security. The core problem is that most text-to-SQL pipelines expose the full database schema to the language model, which then generates valid SQL against tables the user cannot access — returning an empty result indistinguishable from a genuinely empty one. Unlike a true error, this failure produces no exceptions, no log entries, and no alerts, meaning a user may act on a confidently wrong answer. The researcher proposes a structural fix: scoping the schema to only tables the caller is permitted to read before any SQL is generated, which detected all 10 unanswerable questions in testing at zero additional model cost. This approach reframes the issue as a pipeline design problem rather than a model quality problem, since the silent-denial rate depends on schema design, role permissions, and query mix — not on which AI model is used.