Run a saved read-only PostgreSQL query.

The SQL lives in the dashboard. The agent chooses a query ID and supplies values separately; it cannot submit arbitrary SQL.

Example business requirement

A support agent needs a customer's account status, but it must not receive the database password or write to production tables.

1. Configure the dashboard connector

Query ID: customer_by_id

SELECT id, status
FROM customers
WHERE id = $1

Add a PostgreSQL DSN that uses TLS and a database account with read-only grants. Quasentra also runs the saved query in a read-only transaction with a timeout.

2. Create the agent tool

def customer_read(customer_id: str) -> dict:
    result = security.execute(
        agent_id="support-agent",
        session_id="ticket-100",
        action="customer.read",
        arguments={
            "query": "customer_by_id",
            "parameters": [customer_id],
        },
        idempotency_key=f"ticket-100-db-{customer_id}",
    )
    return result["output"]

What the output contains

The output contains rows and a truncated flag. Quasentra returns at most 1,000 rows. Query values remain separate from SQL to prevent the agent from rewriting the saved statement.

Verify safely

1. Use a staging database first.
2. Give the database user read-only grants as defense in depth.
3. Run the named query with a known test customer.
4. Try an unknown query ID and confirm it fails.
5. Confirm DNS, TLS, login and grants with a real staging call; the dashboard validation button does not connect to PostgreSQL.