Dedicated non-owner role
A login template with explicit non-superuser attributes and a connection limit.
Free PostgreSQL security resource
Postgres AI Access Security Kit
A reusable SQL template for restricting AI tools, agents, and MCP clients at the PostgreSQL boundary. Start with a non-owner role, grant only reviewed objects, then prove both allowed and denied behavior.
Review every identifier and statement before use. The kit intentionally does not contain a password, broad PUBLIC revocations, or automatic production session termination.
After the download
Turn the restricted PostgreSQL account into a hosted MCP link
Keep the database account from the kit as the backend boundary. Connect it to datamcp, create a separate MCP link, and choose the client-facing permissions before adding the endpoint to your AI tool.
- 01
Apply and test the restricted account
Replace every placeholder, then verify both allowed and denied operations.
- 02
Connect the database
Use the restricted account rather than an owner or administrative credential.
- 03
Create and test the MCP link
Start with the narrowest client permissions and verify the link from the intended MCP client.
What is included
One boundary, reviewed from creation to revocation
Reviewed object grants
Database CONNECT, schema USAGE, and SELECT on an explicit relation list.
Future-object control
Owner-specific ALTER DEFAULT PRIVILEGES with a clear opt-out for explicit review.
Operational guardrails
Statement, idle-transaction, and read-only defaults kept separate from authorization.
RLS review points
A fixed-tenant example plus warnings about ownership and BYPASSRLS.
Allowed and denied tests
A small regression matrix for reads, sensitive tables, writes, DDL, and tenant boundaries.
Emergency controls
NOLOGIN, privilege revocation, future-default revocation, and a reviewed re-enable path.
Validation matrix
A successful SELECT is not a security test
The downloadable file keeps the destructive-looking checks commented out. Run them one at a time against disposable fixtures or an approved test environment, while connected through the same role and path the AI integration will use.
| Test | Expected |
|---|---|
| Approved relation read | Allowed |
| Sensitive base table read | Denied |
| INSERT, UPDATE, DELETE | Denied unless explicitly granted |
| DDL in approved schema | Denied |
| Row outside tenant policy | Zero rows or denied |
| Query beyond timeout | Cancelled |
Add a separate client boundary
PostgreSQL remains the final enforcement layer
A hosted MCP gateway can add per-client authentication, narrower link permissions, attribution, and independent revocation. It should not replace the restricted PostgreSQL role from this kit.