Read-only Postgres roles for AI agents need seven extra safeguards

A read-only Postgres role is a sensible first step for AI agents, but the author argues it is not sufficient on its own. The article tests a baseline setup on PostgreSQL 16.15 using a sample schema with customers, orders and secrets tables. It shows that the read-only setting is only a default that a session can override, and that timeouts can be disabled. It also explains that SECURITY DEFINER functions can write data on an agent's behalf, that table names remain visible, and that broad grants expose more data than intended. The piece concludes with a hardened configuration covering these seven gaps.