How one team built 400 lines of code to safely let AI query customer databases

A software team built an AI agent that reads support tickets, queries customer databases, and returns findings with SQL evidence attached. Rather than relying on prompt instructions to restrict the AI's behavior, the team enforced every safety rule through code that parses and inspects the generated SQL as an abstract syntax tree (AST). The system rejects anything other than a single, plain SELECT statement and blocks a denylist of dangerous SQL node types — including constructs like SELECT INTO and FOR UPDATE that technically parse as SELECT but can write data or acquire locks. All table references are validated against an allowlist by traversing the full AST, catching hidden reads inside CTEs, subqueries, and UNION clauses that naive string checks would miss. The codebase is open-source under the Apache 2.0 license, and the team notes the approach was refined after getting it wrong twice before arriving at the current design.