Text-to-SQL Guardrails Checklist for ERP

0%

0 of 31 items complete

11 critical items still open - these are the highest-risk gaps.

Download checklist:

Database permissions

Agent uses a dedicated account, not an application or admin accountCRITICALAccount has SELECT only on approved views or tablesCRITICALNo EXECUTE rights on stored procedures that can writeCRITICALSensitive columns (bank, tax id, salary, personal data) are denied or maskedCRITICALRow-level limits apply by site, company or user roleConnection comes from a read replica or reporting copy where availableCredentials are stored in a secrets manager and rotated

Query validation before execution

Generated SQL is parsed and only a single SELECT statement is allowedCRITICALSemicolons, comments and multiple statements are rejectedCRITICALAllow list of tables and views is enforced in code, not in the promptCRITICALFunctions that read files, run commands or link servers are blockedA row limit (TOP or LIMIT) is added when absentQuery timeout is set to a few seconds to a minuteCartesian joins and missing-date-range scans are detected or capped

Performance and cost protection

Estimated plan cost is checked before running heavy queriesConcurrency limit per user and per agentResource governance prevents the agent from starving ERP transactionsCRITICALLarge result sets are summarized by SQL, not pulled into the modelSchema description given to the model is limited to approved objects

Transparency and accuracy

User sees the SQL and the source tables behind each answerCRITICALBusiness definitions (on-hand, backlog, OTD) are stored in a glossary the model usesAnswer states the date range and filters appliedModel says when the data cannot answer the questionGolden question set with known answers is run after every changeWrong-answer reporting button exists and is reviewed weekly

Injection, logging and operations

Free-text fields from ERP records are treated as untrusted contentCRITICALPrompt injection tests include hostile text inside descriptions and notesCRITICALEvery question, generated SQL, row count and user id is loggedLogs are retained per policy and protected from the agent itselfKill switch disables the agent without an ERP changeERP upgrade triggers a re-test of schema descriptions and the golden set

Every critical item should be complete before real users connect. Treat unchecked critical items as launch blockers; non-critical gaps can be scheduled with an owner and date.

Text-to-SQL design review

An optional review of your guardrails, test set and logging for an ERP query assistant.

Optional. The tool and every export work without this. No spam.

How to use it

Work through each group with your DBA and security lead before pilot users connect. Tick items you can evidence with a screenshot, config file or test result. The critical items are those where a failure can expose data or hurt ERP performance. Export the completed list and attach it to your change record or AI governance file.

Principle: the database is the boundary

Prompts guide behavior but do not enforce it. The reliable controls sit outside the model: a read-only account, an allow list of objects, a statement parser and resource limits. If those hold, a model that is confused or manipulated can still only run a bounded SELECT against data it is allowed to see. Transparency then lets users catch wrong but harmless answers.

Permissions and parser are hard controls
Prompts and glossaries improve accuracy
Showing the SQL builds trust and finds errors
Logs allow investigation after an incident

Common mistakes

Teams validate with a regex looking for the word DROP, which misses many risks. Others give the model the entire schema, including tables the user should never see. A subtle failure is hostile text stored in a comment field that instructs the agent to reveal other data, so treat all record text as untrusted. Finally, skipping the performance guard lets one broad query slow the ERP for everyone.

Frequently Asked Questions

Is read-only access enough protection?

It prevents changes but not data exposure or slow queries. You also need object and column restrictions, row limits, timeouts and logging so that read access stays within what each user is allowed to see.

Should we let the model run any SQL it generates?

No. Parse the statement, allow only a single SELECT on approved objects, add limits and timeouts, and then execute. Reject anything that fails these checks and tell the user why.

How do we test for prompt injection?

Insert instructions into test records such as item descriptions or notes, for example telling the agent to ignore rules, then ask normal questions. The agent should ignore them, and permissions should block any attempt anyway.

How often should we re-run the golden question set?

After any model, prompt, schema description or ERP version change, and on a regular schedule such as weekly in early production. Track the pass rate over time to see drift.

Netray ERPray answers questions over live ERP data in read-only mode and shows the query it ran. We can assess your own text-to-SQL design against this list.

Talk to an Expert Explore More Free Tools

Related Tools

Developer Tools

More AI Agents & Automation tools

See all

Text-to-SQL Guardrails Checklist for ERP Data