Limits and safety

Read-only SQL#

• run_sql runs one SELECT (or WITH … SELECT): at most 500 rows and 5 seconds.
• Reads run as a read-only database role, one statement at a time.
• Only tables and columns describe_schema lists are readable; hidden columns are removed from every result.
• Row limits on a key are applied by Postgres, and the signed-in person's own access is the ceiling.

Writes: propose, confirm, undo#

// 1. The agent proposes; nothing is saved
propose_write({
  "summary": "Mark job 1042 as completed",
  "sql": "UPDATE jobs SET status = 'completed' WHERE id = 1042"
})
// => rows it would affect, sample before -> after values, and a pending_id

// 2. A person agrees, then the agent applies it
confirm_write({ "pending_id": <pending_id> })
// => the rows changed and an undo_id

// 3. Changed your mind?
undo_write({ "undo_id": <undo_id> })

• A proposal must be confirmed within 30 minutes; a new proposal cancels an earlier unconfirmed one.
• More than 5 rows needs allow_bulk on confirm; more than 1,000 rows is refused.
• Only tables and columns marked writable can change, and tables behind an approval gate are not writable by AI.
• A workspace's own actions carry its checks and validations, so an AI should use them instead of raw SQL when one fits.

Messages#

• Email and SMS are drafted first and sent only by confirm_send after a person has read them.
• Email goes only from the person's own connected mailbox, at most 20 sends an hour per key, inside the workspace's quiet hours.
• Opted-out numbers are skipped, and inbound STOP, UNSUBSCRIBE and START are applied on every workspace.
• A sandbox never sends email, texts or calls.

Builds#

• Apps save as drafts and are checked (lint, SQL against the real database, navigation) before saving; publishing is a separate step.
• New automations, agents and workspace tools are saved switched off.
• Builds only ever add: tables and columns can be dropped only if they were created through MCP.
• Public apps are never created or changed.

Import and export#

• import_records prepares up to 1,000 rows from CSV, tab-separated text or a stored spreadsheet, shows what would be added or updated, and applies on confirm_write.
• export_csv saves up to 10,000 rows from one SELECT; the link is public to anyone who has it.
• In the web app, screens can import xlsx, xls and csv files and export CSV or Excel.

Audit and oversight#

Every AI tool call is logged with the tool, key, person and outcome. Administrators can review it (ai_activity_log, ai_usage_summary), see the full workspace activity trail, set alerts on bulk deletes, off-hours activity or sensitive field changes, and revoke any key or connected app with effect on the next request. See the MCP overview for the full security model.

Checked against the Fieldproxy platform reference on October 18, 2026.