Text-to-SQL Guardrails Checklist for ERP Data
Letting a language model write SQL against an ERP database is powerful and risky. This checklist covers the controls that hold regardless of what the model generates: permissions, validation, limits, transparency and logging.
0 of 31 items complete
11 critical items still open - these are the highest-risk gaps.
Database permissions
Query validation before execution
Performance and cost protection
Transparency and accuracy
Injection, logging and operations
Every critical item should be complete before real users connect. Treat unchecked critical items as launch blockers; non-critical gaps can be scheduled with an owner and date.
Text-to-SQL design review
An optional review of your guardrails, test set and logging for an ERP query assistant.
Optional. The tool and every export work without this. No spam.
How to use it
Work through each group with your DBA and security lead before pilot users connect. Tick items you can evidence with a screenshot, config file or test result. The critical items are those where a failure can expose data or hurt ERP performance. Export the completed list and attach it to your change record or AI governance file.
Principle: the database is the boundary
Prompts guide behavior but do not enforce it. The reliable controls sit outside the model: a read-only account, an allow list of objects, a statement parser and resource limits. If those hold, a model that is confused or manipulated can still only run a bounded SELECT against data it is allowed to see. Transparency then lets users catch wrong but harmless answers.
- Permissions and parser are hard controls
- Prompts and glossaries improve accuracy
- Showing the SQL builds trust and finds errors
- Logs allow investigation after an incident
Common mistakes
Teams validate with a regex looking for the word DROP, which misses many risks. Others give the model the entire schema, including tables the user should never see. A subtle failure is hostile text stored in a comment field that instructs the agent to reveal other data, so treat all record text as untrusted. Finally, skipping the performance guard lets one broad query slow the ERP for everyone.
Frequently Asked Questions
Is read-only access enough protection?
It prevents changes but not data exposure or slow queries. You also need object and column restrictions, row limits, timeouts and logging so that read access stays within what each user is allowed to see.
Should we let the model run any SQL it generates?
No. Parse the statement, allow only a single SELECT on approved objects, add limits and timeouts, and then execute. Reject anything that fails these checks and tell the user why.
How do we test for prompt injection?
Insert instructions into test records such as item descriptions or notes, for example telling the agent to ignore rules, then ask normal questions. The agent should ignore them, and permissions should block any attempt anyway.
How often should we re-run the golden question set?
After any model, prompt, schema description or ERP version change, and on a regular schedule such as weekly in early production. Track the pass rate over time to see drift.
Netray ERPray answers questions over live ERP data in read-only mode and shows the query it ran. We can assess your own text-to-SQL design against this list.
Related Tools
ERP AI Agent Read-Only SQL Server Role Generator
Create a least-privilege SQL Server login and role for an AI agent, with table grants, sensitive column denies and a row filter by site.
Compliance & ContractsAI Data Classification Handling Matrix Worksheet
Decide per data class whether it may be sent to a hosted LLM, an on-prem model or no model, and who approves exceptions.
Compliance & ContractsNIST AI RMF Core Functions Reference for ERP AI
See what the four NIST AI RMF functions ask for and what each looks like for an ERP assistant or agent.
Developer ToolsOllama Modelfile Generator for an ERP Assistant
Build a Modelfile that bakes a grounded, read-only ERP system prompt and sane parameters into a local Ollama model.
More AI Agents & Automation tools
See all- Business Process Automation ROI Calculator
- AI Agent Use Case Prioritizer
- Document Processing Automation Savings Calculator
- AP Invoice Automation ROI Calculator
- Order Entry Automation Savings Calculator
- Quote-to-Cash Cycle Time Calculator
- Manufacturing AI Readiness Assessment
- RPA vs AI Agent Selector
- ERP AI Maturity Assessment
Keep exploring
Free tools
- Enterprise AI Agent Maturity AssessmentScore your organization across ten dimensions of AI agent maturity, from architecture and guardrails to observability, governance, and measured ROI.
- AI Agent Security Review ChecklistA 30-point security review for AI agents that can call tools and write to business systems, covering identity, permissions, prompt injection, data handling, and audit.
- ERP Database Health Check ChecklistA quarterly checklist for the database under your ERP: recovery, integrity, performance, capacity, security and operations.
Guides
- Natural Language Reporting Over Your ERP: A Practical GuideBuild natural language reporting over your ERP the safe way: text-to-SQL guardrails, semantic layers, and why raw text-to-SQL fails on real ERP schemas.
- Natural Language Query Over ERP Data: What Actually WorksNatural language query over ERP data: how text-to-SQL, semantic layers, and RAG let SyteLine and Infor LN users ask questions and get trustworthy answers.
- Natural Language ERP Query Interface: Ask Your ERP Questions in Plain EnglishQuery your ERP using natural language. Transform plain English questions into SQL/API calls with LLM-powered interfaces that democratize ERP data access.
AI on your ERP
- A Private LLM Grounded on Your ERP DataHow a private LLM answers questions on your ERP data: RAG plus text-to-SQL, role-based permissions inherited from the ERP, and where each fits.
- Natural Language Query for ERP Data: Ask SAP, Infor, or Oracle a Question in Plain EnglishSee how natural language query over SAP, Infor, Oracle, and NetSuite data works: grounded text-to-SQL, role-based permissions, and a visible audit trail.