Call for submissions: Platform Engineering meet-ups
Rootconf
Rootconf

Call for submissions: Platform Engineering meet-ups

Share your journey of building platforms that power engineering teams

All submissions

Sanchit Khanna

@sanchitkhanna

Trust No Agent: Zero-Trust Security Where the Query Meets the Data

Submitted Aug 21, 2026

Session type: Talk (30 mins) Submission made for: Bangalore meet-ups

Abstract

AI agents are connecting to production databases with credentials we built for humans, long-lived API keys, shared service accounts, and over-scoped SQL roles. But an agent isn’t a human operator: it interprets a goal, generates SQL on the fly, and executes at machine speed with no pause to reconsider. RBAC grants coarse capabilities: DELETE on a table, DROP in a schema, that a careful human almost never misuses. An agent will: a WHERE-less DELETE, an unbounded rewrite that pins CPU, a DROP with no backup behind it, each fully authorized by RBAC and still catastrophic. Rotated keys and edge gateways don’t help, because the caller is already inside and acting within its grants. These aren’t slower versions of human mistakes; agents make them at machine speed and at scale.

So we moved enforcement from the edge, where anyone can claim to be authorized, to inside the database, where the query meets the data. CockroachDB now has a two-plane Zero Trust design. Agentic Identity (control plane) replaces shared keys with per-agent short-lived JWT/SPIFFE credentials, scoped access, and just-in-time elevation gated by human approval, so a stolen credential grants nothing durable. Agent Shield (data plane) is a deny-by-default firewall that classifies queries on the resolved plan, after authentication, it sees the actual objects and rows a query will touch, can’t be bypassed by connecting directly the way a SQL proxy can, and enforces with the session, RLS, and column-masking context a proxy never has. This talk covers the design, a worked agent-driven scenario, and a watch → approve → enforce rollout for live workloads.

Why it matters

  • Removes standing privilege, not just rotates it: per-agent short-lived identity means a leaked credential is useless and a compromised agent finds nothing cached to escalate. This is the capability-removing control.
  • Catches destructive queries RBAC authorizes: plan-level, deny-by-default enforcement blocks WHERE-less DELETE, unbounded SELECT *, and unauthorized DROP that authentication alone will always let through. This is defense-in-depth, it raises the cost of misuse; short-lived identity is what makes the attack impossible.
  • Fails closed and rolls out safely: deny-by-default means the safe failure mode, and watch → approve → enforce lets teams learn each agent’s real query profile (and tune out false positives) before anything is blocked.

Key Takeaways

  • Move enforcement onto the query plan inside the engine. A SQL-aware proxy parses strings and can be routed around; enforcement on the resolved plan, after auth, sees what the query actually touches and can’t be bypassed.
  • Ask of every guardrail: does it make the attack impossible, or merely tedious? Short-lived identity removes capability (impossible). Query-shape rules raise cost (tedious), real defense-in-depth, not an airtight barrier. Knowing which is which is the whole design discipline.

This talk covers

  • The threat model: why an autonomous, machine-speed, self-generating-SQL caller breaks RBAC, API keys, and edge gateways.
  • The two-plane design: identity (control plane) and plan-level enforcement (data plane), and why you need both.
  • Portability: the principle, our CockroachDB implementation, and what you’d need to build it on Postgres/MySQL or your own stack.
  • A worked scenario: an LLM agent generates a destructive query on its own; Shield blocks it on the plan; the agent requests elevation and a human approves. (Shown live or as a recorded walkthrough.)

Beneficial for

  • Platform & security engineers building guardrails for AI/LLM-powered applications
  • SRE, DevOps & database engineers evaluating access control for agentic workloads
  • Engineering & security leaders defining “production-ready” for autonomous systems

Bio

Biplav Saraf, Senior Staff Product Manager at Cockroach Labs.

All submissions

Comments

{{ gettext('Login to leave a comment') }}

{{ gettext('Post a comment…') }}
{{ gettext('New comment') }}
{{ formTitle }}

{{ errorMsg }}

{{ gettext('No comments posted yet') }}

Register

Hosted by

Rootconf
Rootconf
We care about site reliability, cloud costs, security and data privacy