# Access control for AI agents on Rails: gating SQL with Action Policy

DevFeed: [Access control for AI agents on Rails: gating SQL with Action Policy](<https://devfeed.tech/articles/access-control-for-ai-agents-on-rails-gating-sql-with-action-policy-19778.md>)

Original publisher: [Read original article](<https://evilmartians.com/chronicles/access-control-for-ai-on-rails-gating-sql-with-action-policy>)

Author: Travis Turner (richardturner@evilmartians.com)

Published: 2026-08-25T00:00:00Z

Content type: tutorial

Language: en

Sources: [Evil Martians](<https://devfeed.tech/sources/evil-martians.md>)

Topics: [Access Control](<https://devfeed.tech/topics/access-control.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Rails](<https://devfeed.tech/topics/rails.md>), [SQL](<https://devfeed.tech/topics/sql.md>), [agent observability](<https://devfeed.tech/topics/agent-observability.md>)

Tags: [access-control](<https://devfeed.tech/tags/access-control.md>), [agents](<https://devfeed.tech/tags/agents.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [llms](<https://devfeed.tech/tags/llms.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [prompt-injection](<https://devfeed.tech/tags/prompt-injection.md>), [rails](<https://devfeed.tech/tags/rails.md>), [ruby](<https://devfeed.tech/tags/ruby.md>), [sql](<https://devfeed.tech/tags/sql.md>)

## AI overview

This article explains how Evil Martians protected sensitive data in an internal Rails AI assistant that uses open-ended SQL analytics. It describes moving authorization from prompts into Action Policy so read-only database access also respects which rows and fields an employee may reveal.

## Source excerpt

Our Rails AI assistant had read-only SQL access and could still return peer review scores. Learn how we kept open-ended analytics in an in-app AI assistant while making database access honor application permissions.