AI agents should prepare database writes, not surprise production

Read-only AI database access is the default for a reason.

But eventually teams ask:

“What if the agent could update the record too?”

The answer should not be: give the model write access and hope.

A safer pattern:

• agent prepares the proposed change
• tool runs validation and dry-run checks
• affected rows and scope are shown
• a human or policy gate approves
• execution uses a narrow write tool
• idempotency key prevents duplicate writes
• audit trail records request, approval, execution, and result

The model can suggest.
The runtime should enforce.
The approver should decide.

Longer version: Approval gates for AI database writes

Production writes should be boring, bounded, and traceable.