SQLGuard

Field note 07

CI gate is not production authorize.

Failing a pull request when a migration looks hostile is valuable. It is still not the same control as verifying an Authorization Receipt at the moment an agent executes against production.

By SQLGuard · · 3 min read

We ship a free CI magnet for a reason: POST /v1/gateway/decide and the sqlguard-authorize-gate Action let teams fail closed on proposed SQL in review. That catches DROP-shaped disasters early.

Agents do not only run migrations from merged PRs. They call MCP write tools, run one-off fixes, and regenerate SQL after the green check. The statement that hits production may not be the statement CI hashed yesterday.

Two moments, two jobs

Review time: decide / deny / comment — cheap, free, fail the PR.
Execute time: PASS + /v1/verify — bind the live statement, then run.

Treat CI as the dress rehearsal. Treat verify as the curtain. Skipping verify because CI passed is how “almost the same SQL” reaches production.

What we recommend

Keep the Action. Paste the challenge CI example. For production mutate paths, require Challenge unlock or Gateway, mint the cert against the SQL you will run, verify, then execute. Host execute on our side stays fail-closed unless explicitly enabled.

If this is your write path

Start with GATEWAY.md and the Challenge on /challenge. Company standing control: Gateway ($299/mo primary).