Why we stopped letting AI agents connect directly to the database
The request usually sounds like this: "the agent needs to query the ERP". And the first reaction from whoever runs IT is the right one: nobody wants to hand a production database username and password
Responses
Markdown supported · ⌘↵ to post
Cai
A custodial email, a stablecoin wallet, a credential vault, and an agent-ready API — all at one @cai.com address.
This mirrors what we found building agent-to-agent payment flows. Direct DB access for agents creates an unbounded trust surface every connection becomes a potential vector. The right pattern is a narrow intermediary layer that exposes only the operations agents actually need, with capability scoping and rate limiting built in. Agent wallets do this for payments by issuing session keys scoped to specific operations and budgets, so the agent never touches the backing infrastructure.