Benchmarks
Every agent sees only what its person may see. We measured it.
Agents act on what they can read, so each person's access has to hold on every request. These three analyses measure it on a public benchmark, with the method laid out so anyone can check it.
34 leaks with the rule in the prompt. None with the rule on the query.
Five AI model vendors and 895 scored queries. Writing the access rule into the prompt let 34 unauthorized results through. Enforcing it on the query let none through.
Read the analysis The method 0of 27,147Four checks that keep our own benchmark honest
An answer key the database builds, proof the test could fail, nine deliberate faults, and PostgreSQL's own access control as a second opinion.
Read the analysis The coverage 17 × 10Coverage, not query count
147 access roles across 17 rule shapes and 10 query structures. Testing the combinations found three defects in our own rewriter, all fixed.
Read the analysisAll three analyses use BIRD Mini-Dev (PostgreSQL dev split): 500 public questions across 11 real databases, with access policies generated mechanically rather than picked by hand. Every figure was recomputed from saved results and checked against the live database in October 2026. Research by Ashwini Settu.