live wire
▸Snowflake agent evals can pin judge versions; unpinned metrics may roll forward and shift scoresSnowflake▸ThoughtSpot makes Spotter 3 default for new instances; it requires download rights and always shares query data with an LLMThoughtSpot documentation▸MotherDuck adds image classification and object location to prompt_jev(), returning typed SQL outputs with confidence scoresMotherDuck▸BigQuery conversational analytics adds Montréal and Toronto; mixed-region agents still default to globalGoogle Cloud Documentation▸Fabric enables Azure OpenAI Copilot access by default, but OpenAI-subprocessor and cross-region processing/storage switches remain offMicrosoft Learn▸Snowflake Cortex Agents now continue by default when named tools are inaccessible, emitting warnings instead of failing the runSnowflake documentation▸Databricks Genie One can use group memberships to tailor answers, while Unity Catalog remains the access-control boundaryDatabricks documentation▸Fabric data agents can query Power BI models with Read alone; Build and workspace access are unnecessaryMicrosoft Learn▸Fabric data-agent Git configs expose column flags, but selecting a table still includes every columnMicrosoft Learn▸Google Data Agent Kit offers remote Spark kernels, but notebook exports can still move results into local Pandas or ArrowGoogle Cloud Documentation▸Cube says production analytics agents need explicit partial-result states, caller-filtered model search and durable artifactsCube▸Thinking Machines names Bridgewater behind ReViSQL-K2.6, citing 92.97% SC-16 accuracy at 15% of frontier-model costThinking Machines Lab▸AWS says a mismatched data/tool/prompt release cut its Field Sales agent pass rate from 78% to 38% in pre-productionAWS Artificial Intelligence Blog▸NL2SQL Multi-Agent ships evaluation artifacts across BIRD, CSpider, Archer and KDD DataSpace—but no software licenseGitHub▸Snowflake agent evals can pin judge versions; unpinned metrics may roll forward and shift scoresSnowflake▸ThoughtSpot makes Spotter 3 default for new instances; it requires download rights and always shares query data with an LLMThoughtSpot documentation▸MotherDuck adds image classification and object location to prompt_jev(), returning typed SQL outputs with confidence scoresMotherDuck▸BigQuery conversational analytics adds Montréal and Toronto; mixed-region agents still default to globalGoogle Cloud Documentation▸Fabric enables Azure OpenAI Copilot access by default, but OpenAI-subprocessor and cross-region processing/storage switches remain offMicrosoft Learn▸Snowflake Cortex Agents now continue by default when named tools are inaccessible, emitting warnings instead of failing the runSnowflake documentation▸Databricks Genie One can use group memberships to tailor answers, while Unity Catalog remains the access-control boundaryDatabricks documentation▸Fabric data agents can query Power BI models with Read alone; Build and workspace access are unnecessaryMicrosoft Learn▸Fabric data-agent Git configs expose column flags, but selecting a table still includes every columnMicrosoft Learn▸Google Data Agent Kit offers remote Spark kernels, but notebook exports can still move results into local Pandas or ArrowGoogle Cloud Documentation▸Cube says production analytics agents need explicit partial-result states, caller-filtered model search and durable artifactsCube▸Thinking Machines names Bridgewater behind ReViSQL-K2.6, citing 92.97% SC-16 accuracy at 15% of frontier-model costThinking Machines Lab▸AWS says a mismatched data/tool/prompt release cut its Field Sales agent pass rate from 78% to 38% in pre-productionAWS Artificial Intelligence Blog▸NL2SQL Multi-Agent ships evaluation artifacts across BIRD, CSpider, Archer and KDD DataSpace—but no software licenseGitHub
nl2sql.ai
analysisNew entrant

SchemaFence puts deterministic SQL checks between a database agent and execution

The new MIT project treats retrieval quality and database safety as separate problems—but it is still an unadopted, author-evaluated prototype.

SchemaFence query path with a hard safety gate.
AI-generated diagram
By The Tools Desk· Oct 15, 2026the quick take — two AI hosts go live when you do

SchemaFence is a new open-source PostgreSQL assistant built around a useful architectural claim: the component that answers database questions can be probabilistic, but the component that decides whether SQL may execute should not be. The MIT-licensed repository was created on October 9 and was still being updated on October 15; at the time of review it had no stars, forks or tagged release, so this is an inspectable prototype rather than an adopted tool.[^1]

Two systems, one boundary

The project divides its work into an agent and a deterministic layer. The agent retrieves operational knowledge and can call four tools—document search, read-only SQL, query explanation and table statistics. The repository says every tool call passes through the same guard and is appended to a JSONL trace with the decision, layer and duration.[^1]

The other half reviews schemas and SQL without asking a model to decide. Its static checks look for ambiguous tables or columns, nullable join keys, type and precision mismatches, NULL traps, measure multiplication after one-to-many joins and LEFT JOIN filters that silently change semantics. A separate execution fence enforces a single statement, read-only shape, deny-listed keywords and functions, a table allow-list, a forced LIMIT, auditing and session hardening.[^1]

That separation matters because a retrieval miss and an unsafe query have different consequences. SchemaFence’s README explicitly keeps retrieved text out of the authorization path: low-quality retrieval can produce weak advice, but only fixed guard logic determines whether a statement runs.[^1]

Rules are data, not model calls

SchemaFence also makes review policies JSON rule packs rather than hard-coded checks. Packs declare selectors and assertions over a closed vocabulary and include positive and negative examples. The loader refuses a pack if those examples do not pass. An inference command can search the vocabulary for a rule that separates supplied examples, but a person still reviews the generated file before use.[^1]

The repository reports self-tests covering 13 guard cases, 10 router cases, seven tool cases and 12 SQL-check cases. It also publishes retrieval evaluations, including an author-reported 97.7% top-five result over 44 questions in its small offline setup. Those numbers are useful as implementation evidence, not comparative proof: there is no independent reproduction, public adoption signal or standard text-to-SQL benchmark result yet.[^1]

What to watch

SchemaFence is notable less for another natural-language SQL interface than for drawing a hard line between advisory AI and executable policy. The directory entry is worth tracking for tagged releases, bypass fixes, external testing and real deployments. Until those arrive, teams should treat its committed tests and reports as a reviewable starting point—not a production safety certification.

[^1]: SchemaFence repository, README and GitHub metadata

sources

Filed by The Tools Desk. Corrections: desk@nl2sql.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk