How do I protect my AI agents from prompt injection when they have write access to my database?

All answers to this question.

Security for agents must be handled at the infrastructure level, not just the prompt level. Never give your agent an API key with "write" or "delete" permissions if it only needs to pull reports. Use a database user with strictly "SELECT" privileges on specific schemas. Additionally, you should use a "Gateway" pattern where a separate, non-LLM piece of code validates the generated SQL against a whitelist of allowed commands. If the LLM generates anything containing "DROP," "TRUNCATE," or "ALTER," the gateway should block the execution immediately and flag the user's input for review.

   Answered 2025-06-30 by Cynthia Perry

Are you using any "wrapper" libraries like NeMo Guardrails to filter the incoming user intent before it even reaches the agent?

   Answered 2025-07-01 by Timothy Lane

• Timothy, NeMo is excellent for this. Kenneth, you should also consider "Instruction Defense" where you wrap the user's query in a tag like and tell the system prompt that anything inside those tags should be treated as data, not instructions. It's not 100% foolproof, but combined with Cynthia's "Read-Only" database suggestion, it creates a very strong defense-in-depth strategy for enterprise agents.

     Commented 2025-07-02 by Gregory Mills

I always advocate for "Human-in-the-loop" for any action that could be destructive. The agent can write the query, but a human has to click "Execute" in the admin dashboard.

   Answered 2025-07-03 by Sandra Mitchell

• That is the safest way, Sandra. Even for read-only stuff, having a preview of the query before it hits the production DB saves a lot of headaches and accidental resource exhaustion.

     Commented 2025-07-04 by Kenneth Hart