Refused, not regretted
A policy gate stops a destructive change before it runs. An unqualified DELETE or a DROP TABLE from an agent never reaches your data, and every refusal is recorded. The rules guard against mistakes, not attackers: the access controls and the Blackbox handle those.
Defaults that ship switched on
Guardrails catch the accident: the agent that loops, the migration that forgot its WHERE. Someone determined to do damage is stopped by roles, keys and the record of what they tried.
No silent drops
DROP TABLE, DROP SCHEMA and TRUNCATE are blocked by policy unless an admin overrides them, and the attempt is recorded.
No WHERE, no run
An agent’s UPDATE or DELETE without a WHERE is refused outright.
Row limits
In the next release: an agent may change at most 100 rows of a table per statement, and 1,000 rows of a table per hour.
Why a row counter
PostgreSQL 18 in a 4-vCPU, 4 GiB test VM, a 1,000,000-row table, median of seven rounds, in milliseconds. The row counter ships in the next release.
| Case | No guard | Row counter | Transition table |
|---|---|---|---|
| A person updates every row | 2,443 | 3,195 | 2,653 |
| A person deletes every row | 311 | 771 | 476 |
| An agent deletes every row | 273, not refused | 14.5, refused | 505, refused |
| An agent updates 50 rows | 5.8 | 8.8 | 5.8 |
The row counter stops an agent’s mass delete at row 101, 35 times faster than counting after the fact. It costs people a little more on bulk writes; on ordinary statements of a few rows neither design is noticeable.
Change the limits per table
From the next release, both limits can be set per table and per branch. fox policy check tells you whether a statement would be blocked before you run it. An admin can let a single statement through when it really is meant.
$ fox guardrail limit --table orders 500 $ fox guardrail budget --table orders --per 1h 5000 $ fox policy check "DROP TABLE invoices"
Your own rules, and what a change would touch
Policy rules and impact analysisEnterprise
Write your own rules and see what a change would affect before it runs.
Free in every edition
Reading the rules, checking a statement against them and the evaluations log.
Let people and agents move fast, safely.
The guardrails are on from the first install. Tune them per table when you need to.
$ curl -fsSL https://get.thefoxbyte.com/install.sh | sh