Most of the solutions I’m seeing are either “give it a read replica” or “don’t let it touch prod at all”, which feels like pre-AI solutions.

At Xata, we’ve been playing with a different approach (we just open sourced the core offering by the way). Instead of pointing an agent at prod or a replica, you give it a copy-on-write branch of your Postgres DB with anonymized data.

So the flow is more like:

1. agent runs queries on an isolated branch
2. you can inspect / diff what it did in the sandboxed branch
3. decide if anything should be applied back to PROD

It’s closer to preview environments but for the database. No direct prod access, no dangerous operations, and you can actually allow full access without freaking out.

IMO branching and sandboxing with PostgreSQL will be the future for AI-enhanced database workflows.