QueryShield — Policy-Aware Query Validation Before Execution

Status: Full run complete · part of the agent-authorization and tool-security line of work.

The question

When an LLM agent is the natural-language front end to a database, the component deciding what to query is the same component exposed, unfiltered, to adversarial input. QueryShield moves the decision out: the agent’s intent is compiled to a structured intermediate representation, and that IR is validated against role permissions before any SQL executes.

Results so far

• The bypass was reproduced, then closed. Against a manager/Engineering role on a real database, the v4 validator leaks on 6 of 6 adversarial plans; v5 leaks on 0 of 6.
• The failure class is aggregate-shaped, not row-shaped. The clearest case is a GroupBy(name) over AVG(salary): v4 allows it, and the average of a one-person group is that person’s exact salary with certainty. Blocking row-level access to a sensitive column does nothing about this.
• v4 is deliberately left untouched in the repository so the bypass stays reproducible as evidence rather than being quietly overwritten by the fix.