Text-to-SQL needs a schema slice, business meaning for columns, permitted tables, and an expected result shape. The generated statement must be parsed or inspected before execution and run through a read-only connection with narrowly scoped grants, statement timeout, and row limit. Do not rely on a model's claim that its SQL is safe. Parameterize user values and keep identifiers on an allowlist. Review joins and aggregation for business correctness; a syntactically valid query can count the wrong events or leak rows from another tenant.
Make this comfortable
SQL prompts: generate a query under database-enforced limits
Decision in practice
An analyst asks for failed settlement batches for account AC-713 during a seven-day window. The assistant receives only the settlement_batch schema and a definition of failed state. It returns a read query with a bound account ID and two date parameters. The executor rejects a query that names a customer_profile table or lacks tenant filtering. A test dataset includes a batch from a different account with the same status, so an omitted account predicate is detected. The result is capped before display and no write grant exists on the database role.
Allowed tables: settlement_batch.
Required filters: tenant_id, state=failed, created_at window.
Parameters: account_id, start_time, end_time.
Executor: read-only role, timeout, row cap; reject other tables.
Pass: no cross-account rows in test result.Performance and operating cost
Parsing and permission checks add overhead but are small compared with a full-table scan caused by a poor query. A row cap protects the client but does not necessarily reduce database work if filtering or indexing is weak. Inspect the query plan for large datasets and bound the time window. Count rejected statements and wrong-result cases separately. Database permissions and tenant predicates are hard boundaries; prompt wording improves candidate quality but cannot replace either one.
Common Mistakes
- Do not execute generated SQL with an administrator role.
- Do not interpolate customer values into a query string.
- Do not assume valid SQL returns the correct business result.
Connected lessons
- Prompt engineering applications
- Prompt Engineering
- Generated output: validate again at the destination boundary
- Tool calls: validate intent and arguments before an external effect
- Coding prompts: name the files, behavior, and proof
- Image prompts: specify the visual contract and inspect the pixels
- Project: produce a checked multimodal incident brief
- Applied prompt engineering decisions
Related implementation
Continue with: Aggregation prompts: pin the denominator and recompute the rate.
prompt engineering
tutorial