# Text-to-SQL Guardrails Checklist for ERP Data > Source: https://netray.co/tools/text-to-sql-guardrails-checklist-for-erp-data > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Check that an LLM that writes SQL over your ERP is limited by database permissions, query validation, cost limits and audit trails. ## Category ai-automation ## Audience - IT manager - DBA - ERP architect - Security engineer ## Tool **Kind:** checklist **Groups:** #### Database permissions **Items:** **Text:** Agent uses a dedicated account, not an application or admin account **Critical:** true **Text:** Account has SELECT only on approved views or tables **Critical:** true **Text:** No EXECUTE rights on stored procedures that can write **Critical:** true **Text:** Sensitive columns (bank, tax id, salary, personal data) are denied or masked **Critical:** true Row-level limits apply by site, company or user role Connection comes from a read replica or reporting copy where available Credentials are stored in a secrets manager and rotated #### Query validation before execution **Items:** **Text:** Generated SQL is parsed and only a single SELECT statement is allowed **Critical:** true **Text:** Semicolons, comments and multiple statements are rejected **Critical:** true **Text:** Allow list of tables and views is enforced in code, not in the prompt **Critical:** true Functions that read files, run commands or link servers are blocked A row limit (TOP or LIMIT) is added when absent Query timeout is set to a few seconds to a minute Cartesian joins and missing-date-range scans are detected or capped #### Performance and cost protection **Items:** Estimated plan cost is checked before running heavy queries Concurrency limit per user and per agent **Text:** Resource governance prevents the agent from starving ERP transactions **Critical:** true Large result sets are summarized by SQL, not pulled into the model Schema description given to the model is limited to approved objects #### Transparency and accuracy **Items:** **Text:** User sees the SQL and the source tables behind each answer **Critical:** true Business definitions (on-hand, backlog, OTD) are stored in a glossary the model uses Answer states the date range and filters applied Model says when the data cannot answer the question Golden question set with known answers is run after every change Wrong-answer reporting button exists and is reviewed weekly #### Injection, logging and operations **Items:** **Text:** Free-text fields from ERP records are treated as untrusted content **Critical:** true **Text:** Prompt injection tests include hostile text inside descriptions and notes **Critical:** true Every question, generated SQL, row count and user id is logged Logs are retained per policy and protected from the agent itself Kill switch disables the agent without an ERP change ERP upgrade triggers a re-test of schema descriptions and the golden set **Scoring Note:** Every critical item should be complete before real users connect. Treat unchecked critical items as launch blockers; non-critical gaps can be scheduled with an owner and date. ## Content **Intro:** Letting a language model write SQL against an ERP database is powerful and risky. This checklist covers the controls that hold regardless of what the model generates: permissions, validation, limits, transparency and logging. **Sections:** #### How to use it **Body:** Work through each group with your DBA and security lead before pilot users connect. Tick items you can evidence with a screenshot, config file or test result. The critical items are those where a failure can expose data or hurt ERP performance. Export the completed list and attach it to your change record or AI governance file. #### Principle: the database is the boundary **Body:** Prompts guide behavior but do not enforce it. The reliable controls sit outside the model: a read-only account, an allow list of objects, a statement parser and resource limits. If those hold, a model that is confused or manipulated can still only run a bounded SELECT against data it is allowed to see. Transparency then lets users catch wrong but harmless answers. **Bullets:** - Permissions and parser are hard controls - Prompts and glossaries improve accuracy - Showing the SQL builds trust and finds errors - Logs allow investigation after an incident #### Common mistakes **Body:** Teams validate with a regex looking for the word DROP, which misses many risks. Others give the model the entire schema, including tables the user should never see. A subtle failure is hostile text stored in a comment field that instructs the agent to reveal other data, so treat all record text as untrusted. Finally, skipping the performance guard lets one broad query slow the ERP for everyone. **Cta:** Netray ERPray answers questions over live ERP data in read-only mode and shows the query it ran. We can assess your own text-to-SQL design against this list. **Faq:** #### Is read-only access enough protection? **Answer:** It prevents changes but not data exposure or slow queries. You also need object and column restrictions, row limits, timeouts and logging so that read access stays within what each user is allowed to see. #### Should we let the model run any SQL it generates? **Answer:** No. Parse the statement, allow only a single SELECT on approved objects, add limits and timeouts, and then execute. Reject anything that fails these checks and tell the user why. #### How do we test for prompt injection? **Answer:** Insert instructions into test records such as item descriptions or notes, for example telling the agent to ignore rules, then ask normal questions. The agent should ignore them, and permissions should block any attempt anyway. #### How often should we re-run the golden question set? **Answer:** After any model, prompt, schema description or ERP version change, and on a regular schedule such as weekly in early production. Track the pass rate over time to see drift. ## Search terms text to sql security checklist, llm sql injection guardrails, natural language query erp database safe, ai generated sql validation, read only llm database access, text2sql production checklist, ask your erp guardrails --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json