Architecture

The pipeline

Every request from every agent travels the same path:

authenticate → parse → classify → evaluate policy → deduplicate →
gate (human, if required) → rewrite → execute → classify outcome → mask → record

There is no second route to the database. The connector’s credentials live in the gateway, and every step above runs for every request. Two orderings carry weight:

Deduplicate before the gate. A retry of something a human already approved replays rather than asking them again.
Rewrite before the gate. The human approves the statement that will actually run — scope conjunct, column list, masks, limits and all. Approving the agent’s original draft would be approving something else.

The Operation IR

Warden does not work on SQL strings. Each request is parsed into an engine-neutral Operation: its class, verb, the resources it targets and how it touches each, its predicate, its mutation, its blast radius, and any hazards. That is what makes one policy language work across relational, document, and graph stores, and one audit schema describe all of them. It is also what makes classification honest: class comes from structure, never from the leading keyword.

WITH gone AS (DELETE FROM orders RETURNING *) SELECT * FROM gone;

That statement begins with WITH and reads like a query. It is a delete, and Warden classifies it as one. For PostgreSQL, parsing uses PostgreSQL’s own grammar — the server’s real parser, linked in — so Warden’s idea of what a statement does cannot drift from the server’s. A protobuf reflection walk then finds every table reference, including those in CTEs, subqueries, and USING clauses; nothing hides in a corner of the tree.

Governed relations

Scoping by filtering result rows is defeated by one alias. Warden enforces restrictions inside the statement instead: each governed table is replaced by a subquery that is already scoped, column-projected, and masked.

-- what the agent wrote
SELECT c.email FROM shop.customers c JOIN shop.orders o ON o.customer_id = c.id;

-- what PostgreSQL receives (in essence)
SELECT c.email FROM (
  SELECT id, tenant_id, mask(email) AS email FROM shop.customers WHERE tenant_id = $1
) c JOIN ( … ) o ON o.customer_id = c.id;

An alias, a function, a join, or a subquery cannot get around it, because the value the agent’s SQL can reach is already the masked, scoped one. Scope values are bound as parameters and never appear as literals in the rewritten statement.

Layers

   ingress    HTTP API, MCP shim, operator view
   runtime    gate: policy, pause, idempotency, breaker, audit
   engine     connectors: parse, govern, execute, mask
   contract   connector interfaces and the capability model
   domain     the Operation IR, classification, blast radius

Built inward-out, and the dependency rule is enforced in CI: nothing above the connector layer may import a database driver. That is what keeps the IR engine-neutral in fact rather than in intention.

Failure posture

Every error on a decision path is a denial. A construct the parser cannot analyse is refused rather than guessed at; a result that cannot be masked is discarded entirely rather than returned partly masked; a connection that cannot meet its policy does not start. The uncomfortable case is always the one that fails closed.

How Warden works

Engines

The pipeline

The Operation IR

Governed relations

Layers

Failure posture

​The pipeline

​The Operation IR

​Governed relations

​Layers

​Failure posture

The pipeline

The Operation IR

Governed relations

Layers

Failure posture