Read-only by design
The default assumption about an AI tool wired to your database is that it can change things. That assumption is reasonable, and it is the main reason teams do not connect one.
SEMANTIX observes. It does not mutate.
Where the guarantee lives
Section titled “Where the guarantee lives”Not in the UI, and not in a prompt telling the model to be careful. It is enforced underneath, in the SQL layer that every database connector routes through.
Statement whitelist. Every query is parsed, and only a single statement
beginning with SELECT, WITH, EXPLAIN, SHOW, TABLE, or VALUES is
permitted. Anything else is rejected before reaching the database — so an
INSERT, UPDATE, DELETE, DROP, or a second statement appended after a
semicolon never executes.
Row limits. Results are capped, so a careless SELECT * cannot pull a
warehouse into memory.
Quoted identifiers. Schema, table, and column names are quoted when the sampling and exploration queries are built, so a name cannot be used to inject SQL.
Validation before execution. Chat-generated SQL additionally passes an AST validator and a dry-run gate. A query that fails is refused with a structured reason rather than run optimistically.
Which connectors are covered
Section titled “Which connectors are covered”All of the in-product database templates route through the same read-only SQL server: PostgreSQL, MySQL, ClickHouse, DuckDB, Druid, SQL Server, Oracle, Trino, Generic SQL, and Databricks SQL.
Two templates work differently, and it is worth knowing which is which:
- Databricks Genie attaches a remote HTTP MCP endpoint you control. Its permissions are whatever that endpoint enforces.
- Snowflake runs the official Snowflake MCP server, so its permissions are whatever the credentials you supply have.
The read-only guarantee is a property of the in-product SQL path, not of every possible connector. For the MCP-based templates, use a read-only database role.
The Data Explorer
Section titled “The Data Explorer”The SQL playground in the Data Explorer is read-only for the same reason and by the same mechanism. It caps results at 200 rows.
Its column sampling is narrower still: it fetches the distinct non-null values
of one column — a SELECT DISTINCT … LIMIT n against a single column. Not row
samples, not a preview of the table.
Why it matters
Section titled “Why it matters”Read-only access is what makes it reasonable to let an AI near production. It means the worst realistic outcome of a bad answer is a wrong number in a chat window, not a dropped table at 3am. That is a much smaller blast radius, and it is why the governed path can be opened up to analysts without a review step.