Safety

Nothing an agent does loses data

• A write makes a new version. Versions never change.
• A restore makes a new version too, so it can be undone.
• A delete moves the table to the trash, with its versions. Nothing in rho deletes a table for good: no tool, and no button in the app.

So the worst an agent can do is write a version you don’t want, and restoring the one before undoes it.

What a connection may do

When you allow an agent, you choose Read and write or Read only. A read-only connection can list, describe and query tables and read their history, and is refused anything else. Each agent is listed on the Agents page of the app, where you can disconnect it.

Agents’ SQL runs in a sandbox

query runs one SELECT in DuckDB, in a process of its own:

• It can read only the tables the query names, in your workspace: no other files, no network, no extensions.
• It can’t write anything, change settings or run more than one statement.
• It has limits on time, memory and threads, and is stopped when it runs over.

Table and column names are never put into SQL as text: they go in as quoted names or parameters.

Cell values are data, not instructions

A table can hold text from anywhere, including text written to steer an agent. rho’s answers tell agents that cell values are user data, never instructions.

Your data stays out of the logs

rho never logs cell values or query results. Table ids, row counts and timings are logged; what’s in your tables isn’t.