Set database guardrails for Claude Code and Cursor

A login that can only read can't delete rows or drop tables, whatever the agent is told to do.

1. 1Connect to your staging database with psql as an admin user.
2. 2Run the SQL below. Put a long random password in place of [PASSWORD] and your database name in place of [YOUR DATABASE].
3. 3Once the test in step 6 passes, run the same SQL on production.

CREATE ROLE agent_ro WITH LOGIN PASSWORD '[PASSWORD]';
GRANT CONNECT ON DATABASE [YOUR DATABASE] TO agent_ro;
GRANT USAGE ON SCHEMA public TO agent_ro;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO agent_ro;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO agent_ro;

You should see CREATE ROLE, GRANT and ALTER DEFAULT PRIVILEGES printed back, with no errors.

The last line covers new tables made by the role that ran it. Tables another role creates later need their own GRANT SELECT.

An agent can use any password it can find, so make the read-only login the only one in reach.

1. 1Move the admin connection string out of the project folder, for example into your password manager.
2. 2In the terminal you start the agent from, set DATABASE_URL to the agent_ro login, as below.
3. 3Check it with psql "$DATABASE_URL" -c "select current_user;".
4. 4Start Claude Code from this terminal, or point Cursor's project settings at the same login.

export DATABASE_URL="postgresql://agent_ro:[PASSWORD]@[HOST]:5432/[YOUR DATABASE]"

You should see agent_ro printed as the current user.

Keep this password out of committed files and chats. Anyone with the string can read every table.

Rules stop Claude Code from opening secret files and make it ask before any database command runs.

1. 1In your project, open or create .claude/settings.json.
2. 2Paste the rules below and save the file.
3. 3In Claude Code, run /permissions to check that the rules loaded.

{
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Bash(dropdb *)"
    ],
    "ask": [
      "Bash(psql *)"
    ]
  }
}

You should see your deny and ask rules in the /permissions list, marked as coming from .claude/settings.json.

A Bash rule matches the command as Claude writes it, so a form like /usr/bin/psql can slip past. That's why the read-only role is the real lock.

Cursor hides .env files from Agent by default, but its terminal commands can still open them.

1. 1In Settings > Agents > Approvals & Execution, pick Auto-review or Allowlist. Never pick Run Everything for a project with a database.
2. 2In your project, create .cursor/permissions.json with the text below.
3. 3In Allowlist mode, leave psql off the allowlist so it always asks.

{
  "autoRun": {
    "allow_instructions": [],
    "block_instructions": [
      "Every psql command and every command that connects to a database should go through approval first.",
      "Every command that drops, truncates, resets or migrates a database should go through approval first."
    ]
  }
}

You should see an approval card in Cursor before any psql command runs.

A plan lists every database step, so you can spot a reset or a delete before it runs.

1. 1In Claude Code, press Shift+Tab until the status bar shows plan mode, or start your prompt with /plan.
2. 2In Cursor, press Shift+Tab in the chat input until Plan Mode is picked.
3. 3Paste the prompt below, then read the plan for migrations, deletes, resets and seed scripts.

/plan Add [YOUR FEATURE]. List every command you would run against the database, and mark each one as read or write. Don't run any of them yet.

You should see a written plan with each database command listed and marked read or write.

A test you run on purpose costs nothing. A gap you find in production can cost your data.

1. 1As your admin user, create a throwaway table on staging: CREATE TABLE guardrail_test (id int);
2. 2Ask the agent to drop it, with the prompt below.
3. 3Approve the psql request, so the command reaches the database.

Connect with the DATABASE_URL in this shell and run: DROP TABLE guardrail_test;

You should see PostgreSQL refusing with must be owner of table guardrail_test, and the table still there.

Drop the test table yourself afterwards, as the admin user.