The database has to be a defensive boundary again

For two decades the database has been able to outsource trust to the application layer. The app authenticated users, sanitized inputs, enforced business rules, and the DB just executed whatever came through the connection pool. That worked because the caller was almost always software written by someone, reviewed by someone, and shipped on a release train. Agents don't fit that picture. Once an LLM with tool access holds a live connection to your production database, the assumptions behind the...