WASM Plugin System for Database Proxy with Sandboxed Host Functions and Hot Reload

We present a WebAssembly (WASM) plugin system for a database proxy enabling user-supplied extensibility for authentication, query transformation, caching, routing, and metrics via sandboxed WASM modules. The system uses Wasmtime for WASM execution with a capability-based permission model (12 distinct permissions), configurable resource limits (memory, CPU timeout, filesystem access), hot-reloading of plugins without proxy restart, and a host function API providing database-specific opera-tions (query execution, cache access, schema discovery, metrics recording). While WASM extensibility exists in network proxies (Envoy proxy-wasm, Istio), its application to database proxies with database-specific host functions and a granular capability-based permission model is novel. PostgreSQL and MySQL use native C/C++ extensions that lack sandboxing and crash the server on bugs.