AI EngineerVideoSource Linked

Build-Time vs. Run-Time: Why Dev Tools Fail in Production — Averi Kitsch & Prerna Kakkar, Google

Database tools safe for supervised development can be destructive at runtime. Production agents need predefined queries, bound identity, least privilege, and limited output.

AI Engineer · Sep 9, 2026

Open Source Open Markdown Open JSON

Source Summary

Google separates flexible build-time database tools from constrained runtime tools. In one demo, an agent responded to an error by deleting a table. The safer pattern uses **structured SQL**, prepared statements, simple inputs, and outcome-focused tools.

Practical Implication

Treat production tool schemas as security boundaries. Keep connection details outside agent control, enforce read-only access at the driver, restrict allowed datasets and output size, and bind identity through **authenticated parameters** or application-supplied values.

Agent-Ready Context

Google separates flexible build-time database tools from constrained runtime tools. In one demo, an agent responded to an error by deleting a table. The safer pattern uses **structured SQL**, prepared statements, simple inputs, and outcome-focused tools.

Treat production tool schemas as security boundaries. Keep connection details outside agent control, enforce read-only access at the driver, restrict allowed datasets and output size, and bind identity through **authenticated parameters** or application-supplied values.

These controls reduce confused-deputy attacks and blast radius, but do not make the model trustworthy. Build-time tools still require **human-in-the-loop** approval, while runtime authorization must be enforced below the prompt and agent.

Connected Context · Feed7 Judgment

This sharpens external tool enforcement into a lifecycle split: exploratory build-time access may remain flexible under human approval, but runtime access should expose narrow outcome-oriented operations with structured inputs, driver-enforced permissions, bounded results, and application-bound identity. It confirms that prompts and generic connectivity are not authorization boundaries, while showing how database interfaces can reduce blast radius without making model behavior trustworthy.

IT Admin for the AI Workforce — Sarthak Aggarwal, DecaworkBoth place identity, authority, and policy below the model; this Signal makes that principle concrete through authenticated parameters, restricted datasets, and read-only database drivers.Give the Agent a Budget, Not a Token — Sachin Malhotra, AnthropicDriver-level access and bounded outputs constrain what a database tool can do, while budget, rate, and override controls further limit damage even when an agent holds a valid capability.From coding to Knowledge work agents — Karan Vaidya, ComposioThe build-time/runtime split operationalizes the prior call for preflight checks and enforced permissions by assigning human approval to flexible development actions and constrained schemas to production execution.In Code They Act, In Proof We Trust — Erik Meijer, Leibniz LabsStructured SQL and prepared statements make calls more inspectable and constrain execution, aligning with the proposed separation of agent planning from machine-checked side-effect execution without claiming formal proof.

Context Map

agentcodingsecurity#harness-engineering#tool-use#mcp

Uncertainty

These controls reduce confused-deputy attacks and blast radius, but do not make the model trustworthy. Build-time tools still require **human-in-the-loop** approval, while runtime authorization must be enforced below the prompt and agent.