Who it is forA data team lead who wants to confirm that a finance user's text-to-SQL prompt only includes tables that user may read.
The problemWithout identity-aware selection, a finance question can pull in tables outside finance access, and row-level security then hides every row without telling the user why.
The outcomeYou get the list of tables selected for the finance role on your database, with the prompt sized to those tables only.
What you need first
- Python and pip installed
- For your own database: a reachable Postgres, Oracle, MySQL or SQL Server URL, and the matching schemagate extra
- Optional: a model key only if you want generated answers or AI descriptions
Steps
- Run
pip install 'schemagate[postgres]'to add the Postgres driver. - Run
schemagate select "revenue by month" --url postgresql://localhost/app --principal okta:jdoe --role financeagainst your database. - Check that every table in the output is one the finance role is allowed to read.
- Run the same command with a different
--rolevalue and compare the table lists.
Prompt for your agent
Install schemagate with the postgres extra, then run `schemagate select "revenue by month" --url <postgres-url> --principal okta:jdoe --role finance`. Return the selected table names and state whether any table is one the finance role should not read.
Caveat. The result is only as accurate as the grants Schemagate can see in your database and the roles you pass in, so check the output against your actual access rules.
Use this in your AI agent
Ask your agent
Using the Deduped MCP, get the setup steps for ashishsinha1602/schemagate and "Select tables for one role on your own database"
Add Deduped to Claude Code once
claude mcp add --transport http deduped https://dedupedai.com/mcp
Every Monday: the 5 hottest repos and exactly how to use them. Free, one email a week, unsubscribe anytime.
Get them freeShare: X LinkedIn Hacker News Email Copy link
Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer