# Safety

> Why nothing an agent does can lose data, and how rho runs agents' SQL.

## Nothing an agent does loses data

- A write makes a new version. Versions never change.
- A restore makes a new version too, so it can be undone.
- A delete moves the table to the trash, with its versions. Nothing in rho deletes a table for good: no tool, and no button in the app.

So the worst an agent can do is write a version you don't want, and restoring the one before undoes it.

## What a connection may do

When you allow an agent, you choose **Read and write** or **Read only**. A read-only connection can list, describe and query tables and read their history, and is refused anything else. Each agent is listed on the **Agents** page of the app, where you can disconnect it.

## Agents' SQL runs in a sandbox

`query` runs one `SELECT` in DuckDB, in a process of its own:

- It can read only the tables the query names, in your workspace: no other files, no network, no extensions.
- It can't write anything, change settings or run more than one statement.
- It has limits on time, memory and threads, and is stopped when it runs over.

Table and column names are never put into SQL as text: they go in as quoted names or parameters.

## Cell values are data, not instructions

A table can hold text from anywhere, including text written to steer an agent. rho's answers tell agents that cell values are user data, never instructions.

## Your data stays out of the logs

rho never logs cell values or query results. Table ids, row counts and timings are logged; what's in your tables isn't.