# SQLPermit SQL Guard

> SQLPermit SQL Guard is a paid API for AI agents from sqlpermit.schemasure.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-13).

Validates an agent-authored PostgreSQL statement against a configurable execution policy using PostgreSQL's real parser, returning compliance decisions, reason codes, and optional short-lived signed execution permits.

## Facts

- Endpoint: POST https://sqlpermit.schemasure.com/v1/guard/sql?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sqlpermit-sql-guard-9d8d6a70
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_H4xWOiNCWLoFudorHBDIc

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sqlpermit-sql-guard-9d8d6a70 -d '<json body>'
```

Example prompt: Before running this query on our PostgreSQL 18 database, check it against our read-only policy with a max of 1000 rows and only allow access to the public.orders and public.customers tables — and issue a signed permit if it passes: SELECT o.id, c.name FROM public.orders o JOIN public.customers c ON c.id = o.customer_id WHERE o.status = 'pending' LIMIT 50

## When to prefer this

Use SQLPermit when an AI agent or untrusted process generates SQL that will be executed against a real PostgreSQL database and you need policy enforcement backed by PostgreSQL's actual parser rather than regex or string matching. It is specifically valuable when you need to catch dangerous patterns that look like benign SELECTs — such as data-modifying CTEs, COPY PROGRAM, or privilege-escalating function calls — and when you want a cryptographically signed, short-lived permit that the executor can verify before running the statement, creating a clear audit chain between policy decision and execution.

## Known failure modes

- Unparseable SQL returns a parse error reason code rather than a compliance decision
- Unsupported PostgreSQL major version (anything other than 18) returns a 400-level rejection
- Missing required target_pg_major field causes validation error
- issue_permit=true without an audience value is rejected
- Wildcard audience values are rejected when issuing permits
- Statements exceeding 100,000 characters are rejected at input validation
- Payment not included or invalid x402 payment causes 402 response before processing

## How this service works

Decide whether an agent-authored PostgreSQL statement complies with an execution policy, using PostgreSQL's own parser rather than pattern matching. Detects statement stacking, data-modifying CTEs, COPY PROGRAM, privilege changes, and dangerous functions that read as ordinary SELECTs. Returns reason codes and an optional short-lived signed permit bound to the exact normalized statement. Never connects to your database.

## Output

Returns a compliance decision (allowed/denied), one or more machine-readable reason codes explaining any policy violations detected (e.g. WRITE_DETECTED, FORBIDDEN_FUNCTION, STATEMENT_STACKING, COPY_PROGRAM), the normalized form of the parsed statement, and — when issue_permit is true and the statement passes — a short-lived cryptographically signed permit bound to the exact normalized statement and the specified audience executor, carrying obligations such as max_rows and statement_timeout_ms.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "sql": {
   "type": "string",
   "maxLength": 100000,
   "minLength": 1
  },
  "policy": {
   "type": "object",
   "properties": {
    "max_rows": {
     "type": "integer",
     "minimum": 1,
     "description": "Row ceiling. Becomes a permit obligation the executor enforces."
    },
    "read_only": {
     "type": "boolean",
     "description": "Reject anything that can change data or schema, including writes reached through a CTE."
    },
    "allowed_tables": {
     "type": "array",
     "items": {
      "type": "string"
     },
     "description": "Permitted relations as schema.table, or a bare name to match an unqualified reference."
    },
    "allow_returning": {
     "type": "boolean",
     "description": "Accept RETURNING on a permitted write without a warning."
    },
    "allow_row_locks": {
     "type": "boolean",
     "description": "Accept SELECT ... FOR UPDATE without a warning."
    },
    "allowed_schemas": {
     "type": "array",
     "items": {
      "type": "string"
     },
     "description": "Schemas the statement may reference."
    },
    "allowed_functions": {
     "type": "array",
     "items": {
      "type": "string"
     },
     "description": "Added to the built-in allowlist. Bare name, or schema.function to admit one of your own."
    },
    "allowed_languages": {
     "type": "array",
     "items": {
      "type": "string"
     },
     "description": "Permitted CREATE FUNCTION languages. Defaults to none."
    },
    "statement_timeout_ms": {
     "type": "integer",
     "minimum": 1,
     "description": "Timeout written into the permit obligations. Defaults to 30000."
    },
    "allow_multi_statement": {
     "type": "boolean",
     "description": "Permit more than one statement in the input. Defaults to false."
    }
   },
   "additionalProperties": false
  },
  "dialect": {
   "enum": [
    "postgresql"
   ],
   "type": "string"
  },
  "subject": {
   "type": "string",
   "description": "Opaque caller label recorded as the permit subject."
  },
  "audience": {
   "type": "string",
   "description": "Identity of the ONE executor the permit is for. Required when issue_permit is true. Wildcards are rejected."
  },
  "issue_permit": {
   "type": "boolean"
  },
  "target_pg_major": {
   "enum": [
    18
   ],
   "type": "integer",
   "description": "Required. The PostgreSQL major the statement will run on. Only 18 is supported in v1: a permit issued under one grammar and verified agains
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sqlpermit-sql-guard-9d8d6a70/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from sqlpermit.schemasure.com](https://www.zero.xyz/host/sqlpermit.schemasure.com/llms.txt)