Enforcing Read-Only Agent Access Through Resource Governors and Budget Ceilings Instead of Hope

Read-only agent access needs runtime enforcement. A contained agent needs purpose-scoped roles, pre-execution query limits, and cumulative budgets that remain correct under concurrent load. Isolated compute and full query auditability complete that boundary by keeping the impact on production low and showing what the agent actually did.

Why prompts and read-only flags are not enforcement

A team may believe it has contained an agent because its prompt forbids writes and its database role permits only reads. The architecture makes a narrower promise than that. Enforcement must stop a prohibited effect even if the agent tries to cause it. A read-only role enforces a permission boundary, but it cannot stop every harmful use of permitted data.

Runtime Governance for AI Agents: Policies on Paths distinguishes instructions that shape possible behavior from policies that evaluate an execution path. That distinction becomes concrete when a database read is followed by an external email. Each action may be allowed on its own, but together they cross an information barrier. Read-only does not mean that exfiltration is impossible. An agent can retrieve thousands of customer records and return them through a response routed to an external system without changing a database row.

How agents probe databases differently from human users

A request to prepare a quarterly report can become a sequence of CRM reads, financial queries, external data requests, visualizations, and emails. The agent determines that sequence at runtime. The runtime-governance paper identifies these non-deterministic, variable-length paths as a defining difference from conventional software. As a result, the same task can put different workloads on the database from one run to the next.

This changes more than the number of queries. Fan-out can exhaust a connection pool because the arrival-rate assumptions behind it no longer hold, rather than because someone simply chose too few connections. In a columnar, scan-billed database, a wide query can also use up a lot of resources before anyone notices. An agent does not necessarily hesitate before running it as a human analyst might.

A loop without an exit poses the sharpest risk. In a documented 2025 incident, two agents in a multi-agent research system got into a recursive clarification loop that lasted eleven days. The system had no stop conditions, budget limits, or real-time cost monitoring. For database infrastructure, the lesson is specific. Permission to issue a valid query cannot also mean permission to repeat valid queries indefinitely.

Why uniform governance applied to all agents makes the problem worse

Gartner’s May 2026 projection puts the consequence of governance mismatch in concrete terms. By 2027, 40% of enterprises will demote or decommission autonomous AI agents because of governance gaps discovered only after production incidents. The mismatch runs in both directions. Heavy controls can slow simple retrieval work and encourage shadow deployments, while lightweight controls leave autonomous actions insufficiently constrained.

Level 1 Observe agents need scoped data access, user authentication, usage logging, and basic functional and security testing. Level 4 Act Autonomously agents need continuous monitoring, enforced guardrails, rapid rollback, and circuit breakers. Their ability to act changes the required boundary.

What should this mean for a database team? The agent’s autonomy should determine which governors activate, their thresholds, and the escalation path when a limit is reached. A summarizer and an agent that modifies configurations do not present the same risk. Giving them identical controls confuses a consistent governance process with a uniform enforcement policy.

What scoped roles actually enforce and where they stop

A dedicated database role for each agent identity is the structural floor. The role should be separate from the main application role and grant access only to the tables needed for the task. A prompt cannot substitute for that separation. Where a workflow includes evidence gathering and remediation, different roles or tools should separate reads from writes, with step-up approvals for high-impact actions.

Filtered views can show transaction amounts and timestamps while hiding payment card numbers and customer names. Row-level security restricts which records a query returns, while column-level masking redacts sensitive fields. These controls constrain permitted queries at execution time. They do not depend on the agent remembering an instruction.

Microsoft’s 2026 guidance treats managed identity, explicit role assignment, and human ownership as prerequisites for meaningful role-based access control. Just-in-time elevation keeps that identity stable while granting narrow privileges only for a particular workflow. This also addresses the documented pattern in which a broad Reader role quietly gains write access as a use case expands. Yet a valid credential still permits every query within its scope. Role isolation alone cannot limit how much scans cost or how many queries run.

Pre-execution scan budgets: stopping expensive queries before they run

A pre-execution governor closes that gap by inspecting a query plan before allowing the SQL to run. It retrieves the plan through EXPLAIN or an equivalent mechanism and evaluates it against configured budget dimensions. A query that fails the check never reaches execution.

The distinction is especially important in columnar OLAP systems serving observability data and event streams. An agent that queries raw tables instead of using pre-aggregation can defeat the latency and cost design behind materialized views. Killing that query after it has scanned a trillion rows cannot bring back the compute it has already used.

But what if the planner’s estimate is wrong? The estimate need not be exact to catch a catastrophic query. Even when the estimate is off, it helps to reject a plan expected to scan an order of magnitude more rows than the budget allows. This mechanism bounds individual queries while leaving the total consumption of many queries that each pass inspection unbounded.

Why request-local governance fails under concurrent agentic load

A related experiment identified as arXiv:2609.00275 found that per-effect gates let the fleet overdraw up to 48 times the tenant’s risk limit even though every local gate made the right decision. The contradiction is only apparent. Each decision used a locally valid view, but the combined effects exceeded the shared limit.

Stateful Governance for Concurrent Agentic Systems names the underlying failure stale authorization. Budgets, approvals, and risk signals can change between a request’s evaluation and the moment its effect commits. The paper defines policy-state serializability as the requirement that committed effects be explainable as authorized against the policy state immediately before they occur.

The paper’s MasuGate architecture keeps policies reviewable while coordinating policy state and effects within the trust boundary. Parallel research agents and data-pipeline agents can all use the same pool of database budget. Their limits must thus be kept in shared, mutable state, rather than passed as separate parameters with each request.

Budget ceilings as a policy mechanism, not a billing afterthought

A cumulative budget turns that shared state into an enforceable policy. Under the irreversibility budget pattern, a trusted runtime maintains an account for each principal, charges an effect before it commits, and denies an effect that would overdraw the account. The response occurs before the prohibited consumption. A later invoice cannot provide that protection.

The account also needs more than one dimension. Rows scanned, compute hours, queries issued within a rolling window, and cumulative data returned each track a different way things can go wrong. A query-count limit can catch repetition even when each scan is small. A returned-data limit addresses a risk that a compute budget alone does not describe.

For Level 4 agents, a threshold violation can require suspending the identity. The Treasury Financial Services AI Risk Management Framework, issued in February 2026, recommends purpose-limited access and continuous monitoring evidence in guidance that is voluntary and non-binding. Logged per-principal enforcement decisions make those controls demonstrable without turning the guidance into a new legal obligation. Compute-hour pricing separates capacity consumption from the pressure under per-query pricing to suppress queries simply because each one creates a charge.

The MCP layer and why it requires its own enforcement boundary

Model Context Protocol, introduced by Anthropic in November 2024, connects agents to external systems through a standardized client-server architecture. That connection introduces another credential boundary. If an MCP server uses broad database credentials, the agent can request actions through those credentials regardless of the narrower role intended for it. Database role design cannot constrain a different, more privileged identity used on its behalf.

The July 2025 Supabase-Cursor incident illustrates the consequence. A Cursor AI coding agent encountered SQL exfiltration instructions embedded in support ticket text while operating with a privileged service_role database credential. That credential bypassed row-level security. The exfiltration used a database write back into the support ticket thread, which a read-only role would have blocked.

MCP credentials should have minimum required access, and the server should apply its own query-budget and row-limit checks before forwarding requests. Isolated, read-only compute gives agent workloads a separate context over shared data, with credentials separate from the application’s credential. Logs at the protocol level must also record the instruction, tool call, and arguments. Database query logs show the SQL, but not that full chain of intent and action.

Sandboxed branches and schema-as-code as operational controls for agentic experimentation

Containment still leaves a practical question unanswered. How can an agent explore real data without making production the experiment? Sandboxed branches provide isolated, read-only compute over the same underlying data. A full-table scan then consumes the sandbox’s compute budget, preserving production query capacity. The agent can still use real data shapes and volumes to plan queries and check results.

This approach depends on separating compute from storage. Branches share the underlying durable object store and allocate separate compute, so storage costs are not multiplied by copying the dataset for each sandbox. Isolation means separating the resource whose exhaustion would otherwise affect other users.

Schema-as-code adds a controlled path for schema interaction. Structured commands to describe, validate, and deploy schemas and pipelines give agents an auditable, reversible vocabulary. An agent that exhausts its sandbox budget stops without degrading production queries. Its work must still remain accountable. Every sandbox query should be logged with full fidelity, because bounded consequences do not remove the need to explain a failure.

What a complete enforcement stack looks like and what each layer is responsible for

Within the four layers, structural role isolation controls identity, writes, and cross-scope reads through purpose-scoped permissions, filtered views, masking, row-level security, and time-bound elevation. The pre-execution governor then inspects permitted queries for scan-row, join-depth, and return-row budget violations. Permission and affordability are different decisions. Neither layer alone tracks what a concurrent fleet has already consumed.

Stateful cumulative budgets keep that shared count and block effects based on the policy state at commit time. Circuit breakers can halt an autonomous agent when a threshold is crossed. MCP enforcement and sandboxed compute address the boundary above the database, including privileged credential inheritance and the production impact of experimentation. These controls constrain possible effects without assuming that prompt injection can be eliminated by better instructions.

The stack should remain proportional to autonomy. A Level 1 retrieval agent warrants the structural and pre-execution layers, with baseline authentication, logging, and testing. A Level 4 autonomous agent warrants all four layers, circuit breakers, and rapid rollback.

Finally, the audit trail must connect agent identity, tool call, arguments, query plan, rows returned, budget consumed, and enforcement decision. That connected record shows which boundary allowed or denied each effect, turning a claim of containment into evidence of enforcement.