Never Let Your Agent Touch the Database

Version 1.1 is a vocabulary revision, content-preserving: aligned with The Theory of Data, Version 4.0 — a measure is the governed family; a member of a measure is a governed series; a series is a typed binding of datums over one anchor. Nothing is altered in substance.AI agents can be genuinely useful in analytical systems — interpreting questions, searching governed models, proposing structured requests, explaining results. They should not hold database credentials or control an executable database language. This position argues the prevailing text-to-SQL architecture concentrates three risks in one authority (security, cost, and — least discussed — analytical correctness: queries that execute perfectly and are silently wrong), and that guardrails inspect commands while the failures live in meanings. The alternative is an intent boundary: the model proposes a declaration of the desired result; a governed environment resolves identities, certifies obligations, and owns execution. The model interprets; it never authors the final command. Fifth in the datumwise position series.