SQLGuard · 30s demo

For: the eng on the pager — Platform · DevOps · senior who gets blamed for “who ran DROP TABLE?” — not the CISO buying another scan. Enemy: “we already trust our AI tools.” Wedge: which agent_id authorized this?

The approval firewall

SQLGuard is the thing that stops AI agents from changing production without authorization.

1Panic — agent generates dangerous SQL on prod.
2Felt DENY — no Authorization Receipt; do not execute.
3Prove — authorization at zero cost (free try) or Graduate Pilot $100.00.
4PASS → verify → execute → audit (“which agent_id authorized this?”).
Unique question
Access tools: who has credentials?
Observability: what happened?
SQLGuard: was this exact action authorized before it happened?
Beachhead: AI agents making production database changes · HTTP gate only (no DB proxy yet).
POST /v1/challenge/try prove at $0 · Graduate Exact $100.00
Gateway $299/mo
DENY · no Authorization Receipt

Permission required — no Authorization Receipt

This exact write is not authorized. Production changes need a verified Authorization Receipt before execute.

deny_id: —

Trust bridge: Felt DENY first → prove authorization at zero cost (first 5; 5 PASS / 24h) → Graduate to permanent provenance for Exact Pilot $100.00 (same deny_id). Sold out → waitlist. Not a scan. Not a debt.

Founding Pilot rebate: first unaffiliated Exact Pilot settle ($100.00) → $40 USDC back to the buyer wallet on Base within 24h (net $60). Wire amount stays 100000000. Operator / self-settles excluded. One claim. Proof: GET /v1/money pilot ≥1.

Prove $0: POST https://sqlguard.io/v1/challenge/try · Waitlist: POST https://sqlguard.io/v1/challenge/try/waitlist · Graduate (same deny_id): POST https://sqlguard.io/v1/challenge/unlock · Earn $30

Raw DENY JSON
{}
PASS shape (after unlock)

After you unlock — migration may execute

Paid unlock issues a session_token. Burn via POST /v1/session/cert → POST /v1/verify → only if ok: true may the migration run.

status: PASS kind: Authorization Receipt sql_hash: <bound after unlock> verify: POST /v1/verify → ok:true next: migration may execute

Agents: POST /v1/challenge → prove at $0 /v1/challenge/try (DENY carries) or Exact /v1/challenge/unlock (100000000). Companies: Gateway $299/mo · same demo on /demo