The language of safe agent data access.

Policy runtime

A layer that sits between an AI agent and the database and enforces a declarative policy on every call — deciding which models, fields, and operations are allowed. OrmAI is a policy runtime that wraps your existing ORM.

Typed tool surface

A small, fixed set of structured tools (db.query, db.get, db.aggregate, db.create, db.update, db.delete) exposed to an agent instead of free-text SQL. Because arguments are structured and parameterized, SQL injection is structurally impossible.

Field-level redaction

Removing or transforming sensitive columns before results reach the agent. Denied fields are dropped entirely; masked fields (e.g. email, phone) are transformed so the raw value never leaves the boundary.

Tenant scoping

Automatically filtering every query and write by a tenant identifier taken from the run context — never from the prompt — so an agent cannot read or write another tenant’s rows.

Query budget

Compile-time limits on the cost of a query: maximum rows returned, statement timeout, and join depth. Expensive queries are rejected before they run, protecting the database from runaway agents.

Gated write

A mutation restricted to an allow-list of models, optionally requiring a human-readable reason and capping rows per statement. Writes are auditable and bounded rather than open-ended.

Immutable audit log

A tamper-evident record written before each result returns, capturing the principal, tenant, trace ID, sanitized inputs, and the policy decision. It makes access and isolation provable after the fact.

RunContext

Per-request context carried through an OrmAI call — including the principal and tenant — used to scope queries and attribute audit records. The agent cannot set or override it.

Text-to-SQL

The pattern of asking an LLM to generate raw SQL from natural language. It is prone to injection, unscoped queries, and destructive operations; OrmAI replaces it with a typed, policy-checked tool surface.

MCP (Model Context Protocol)

An open protocol for exposing tools and data to LLM clients such as Claude. OrmAI can mount your database as policy-checked MCP tools rather than a raw SQL endpoint.

Prompt injection

An attack where crafted input steers an agent into unintended actions. OrmAI contains its blast radius: even a fully hijacked agent is confined to the models, fields, and operations the policy permits.

Principal

The identity on whose behalf an agent acts (a user, service, or team). Policies and audit records are keyed to the principal, enabling per-principal permissions.

Want the deeper story? Read why agents shouldn’t touch raw SQL, browse the guides, or see the comparisons.