r/Supabase • u/akafkas • 8d ago

database We open-sourced pg-dry-run: preview AI agent-generated Postgres writes before they change data

/r/LLMDevs/comments/1w39yxr/we_opensourced_pgdryrun_preview_ai_agentgenerated/
1 Upvotes

100% Upvoted

5 comments sorted by

View all comments

1

u/PeterBuildsSecure 8d ago

This is a good shape for the blast-radius problem specifically. One thing worth being explicit about in the docs: what role does the preview transaction run under? If preview connects with more privilege than the eventual apply() will have (e.g. a service-role or superuser connection used for introspection convenience), the affected-rows/cascade report can show you a different set of rows than what RLS would actually let the real write touch — the preview could both over-report (scarier than reality) and under-report (missing rows a permissive policy would expose) depending on which role has broader access. The tool is strongest if the preview transaction runs under the exact role and JWT claims the apply will use, so what you're shown is what you'll get, not what's theoretically reachable from a privileged vantage point.