Do you let your agent touch your database directly, or is that a hard no for you?
by•
Been going back and forth on this. Right now my setup lets Claude Code run migrations and seed scripts directly against a local dev database, but I've kept it firewalled off from ever touching staging or prod, even read-only. Everything that reaches prod goes through a PR I review manually.
Saw a comment in another thread here about a subagent going off-script and targeting its own orchestrator, which made me second-guess even the local access I've been giving it.
Where does everyone else draw this line?
Is read-only prod access ever okay in your setup, or is that a line nobody here crosses?
And for the people who do give agents broader database access, what made you comfortable enough to do that?
35 views
Replies
Hard no, and not by policy. Prod and staging sit behind a VPN and the ssh keys live in 1Password, so even with the VPN open the agent hits a password it doesn't have. It isn't told to stay out. It has no way in.
On read-only prod I'd still be careful. It stops the data being changed, not from leaving. A read query pulls rows into a context window, and from there they go to whoever runs the model. Ours holds what people wrote about their own lives, and we promise that never reaches an AI service. Read-only would break that without changing a single row.