kaxil commented on code in PR #70134:
URL: https://github.com/apache/airflow/pull/70134#discussion_r3617796688
##########
providers/common/ai/src/airflow/providers/common/ai/example_dags/example_agent.py:
##########
@@ -65,6 +65,13 @@ def example_agent_operator_sql():
"the schema and answer the question with data."
),
toolsets=[
+ # ``allowed_tables`` scopes the agent's intent, but it is an
+ # application-level guardrail, not a security boundary. Point
+ # ``postgres_default`` at a least-privilege role whose SELECT
grants
+ # are limited to these tables -- that is the boundary that
holds even
+ # if the agent (which may be under prompt injection) reaches
for data
+ # through a function the parser cannot see. See the "Security"
section
+ # of the toolsets docs.
SQLToolset(
db_conn_id="postgres_default",
Review Comment:
Added `allowed_functions=["json_build_object"]` to the example with a
comment on when it's needed, in 0bc16c8.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
