5 ms·
Can I trust the generated output SQL? I want to turn something like this into a frontend for my customers to use.
by throwaway49849 3y ago
Can I trust the generated output SQL? I want to turn something like this into a frontend for my customers to use.
- saigal 3y agoYes, absolutely. Every AI-generated SQL comes with a confidence score, so that you stay in control. We've had people who set a confidence threshold for returning answers to the users. If confidence threshold isn't met, then there's human-in-the-loop.
- throwaway49849 3y agoI see. Just so I'm clear because this is important, if I set the confidence threshold very high, does it mean that my customers cannot create a malicious query? I don't want them deleting data or accessing rows that they're not allowed to.
- aazo11 3y agoAll DML commands are blocked by the engine. You can wrap the returned SQL in a CTE only passing the rows the customer is allowed to access.
- throwaway49849 3y agoWouldn't the AI-generated query need knowledge of the CTE that will be wrapping it? How would the CTE prevent arbitrary joins, or access to tables that use the fully-qualified `schema.table`? And couldn't somebody execute any arbitrary function on the SQL server? Example `pg_sleep(9999999)`.
- moltar 3y agoYou could set a low query execution timeout for the session.
- throwaway49849 3y agoIt's an incomplete solution.
- fermisea 3y agoHey man, I'm building something in this area, but focused on building specific functions on an iterative basis, skim through the video here https://v2.connectedflow.app/ https://v2.connectedflow.app/ , is this something that you'd use? (Mind you, we're 2 weeks into it)