Developers can't give a coding agent read-only access to a server or database without approving every command by hand.
Developers and system administrators who use coding agents on servers and databases
Where it stands
- Sourced (done)
- Kit (done)
- Wanted (next)
- Building
- Solved
How this problem came to be
- Found2 sourcesnews.ycombinator.com, genai.owasp.org
- Quoted3 claimseach checked against its page
- BriefWrittenand what solved looks like
- Market1 signals85 points on Hacker News
- Kit5 steps17 tools · 6 routes
- People0 want0 live it · 0 would test
The problem, broken down
- Who it hurts
- People who use an AI coding agent to read logs, inspect files and query databases on real systems.
- The moment
- During routine debugging, when the agent asks permission for the tenth repetitive read command in a row.
- What people do today
- People either approve each command, or rely on lists of allowed command names, which an agent can get around with other tools.
- Why it's unsolved
- Filtering command text is fragile. The safer answer, separate accounts and database roles, takes setup most people skip.
- What solved looks like
- A small, documented setup (script or container image) that gives an agent a shell and a PostgreSQL connection where reads run without prompts and every write is refused by account permissions, not by text matching. Checkable with a test list of 30 commands and queries (15 reads, 15 writes, including tricky ones like find -delete or SELECT ... INTO) where every write fails and every read works.
Evidence
Every claim is tied to the source it comes from- 1In a January 2026 Ask HN thread, a developer said they review every command their coding agent runs over SSH, many of them repetitive, and asked how to allow commands like ls, grep and SELECT while blocking rm, chmod, INSERT and DROP.
- 2Replies suggested containers, separate user accounts and read-only database users rather than filtering commands, and one warned that agents have worked around such restrictions.
- 3OWASP lists Excessive Agency as an LLM risk and advises limiting the permissions LLM extensions get to the minimum needed and requiring human approval for high-impact actions.
Builders still need to know
Written from the cited sources. Anything they don't say is left as a question, not a guess.
Sources
From a public page with a citation.
- [1]Ask HN: How do you safely give LLMs SSH/DB access? (January 2026)
- [2]OWASP Top 10 for LLM Applications 2025: LLM06 Excessive Agency
What the source says, in short
In a January 2026 Ask HN thread, a developer said they review every command their coding agent runs over SSH, many of them repetitive, and asked how to allow commands like ls, grep and SELECT while blocking rm, chmod, INSERT and DROP. Replies suggested containers, separate user accounts and read-only database users rather than filtering commands, and one warned that agents have worked around such restrictions. OWASP lists Excessive Agency as an LLM risk and advises limiting the permissions LLM extensions get to the minimum needed and requiring human approval for high-impact actions.
Forks 0
Nobody has forked this yet. Be the first.
Market read
How big this is, from the evidence
- Hacker News ↗Builders' pull · Medium confidence85 points on Hacker News
How these were measured: Points on the Hacker News thread, read from its API.
For whoever takes this up
The builder's path for this problem
Five steps, each with the tools that fit this problem and a word to carry with you. A starter prompt is ready to paste into any assistant.
Open the pathDiscussion 0
No comments yet.