Review a definer routine before admitting it as an AI tool

Select one callable instead of a generated SQL escape hatch

A fictional assistant service needs one bounded internal report while lacking direct access to its source table. Propose parameterless function F-A, identified by one schema, name and exact input signature SIG-A. Its trusted fixed SQL string-body returns only the approved report R-A projection. The model supplies neither SQL nor function, schema, object or role names.

Caller C-A is a trusted backend service identity whose credential is not exposed to users or the model. Dedicated function owner O-A has only the reviewed underlying read rights. O-A is not proposed as a broad administrator or data-table owner. Application authentication and current permission for R-A precede the call; result disclosure is independently bounded.

This is a PostgreSQL 18 documentation profile, not an installed database observation. All cards are PROPOSED_UNRUN. No SQL, function, role, grant, schema, connection, configuration or database experiment was performed.

Separate the function grant from its owner’s data rights

CREATE FUNCTION defines SECURITY DEFINER as execution with the owner’s privileges, rather than the caller’s default invoker rights. That makes the owner and body part of the admitted tool, not incidental deployment metadata.

PostgreSQL privileges distinguishes function EXECUTE, schema USAGE and underlying table or column SELECT. PUBLIC means every role. Record effective permissions, including indirect or PUBLIC paths; a direct grant to C-A does not describe the entire caller set.

Invent admission sheet A-A containing F-A/SIG-A, body revision B-A, owner O-A, required data projection, function configuration and complete intended caller set. Also record who can change those objects. If the owner can read additional sensitive columns, or another role can replace the body, the previous narrow caller review is insufficient.

Do not interpret an empty displayed ACL field as no permissions: the privilege reference explains that a null privilege entry uses defaults. Defaults and actual grants require evidence, not assumptions from a reassuring display.

Bind resolution to the reviewed function environment

The schema reference explains that search-path trust extends to roles with CREATE in a searched schema. Names resolve beyond tables: types, functions and operators matter too. Schema USAGE permits lookup; it does not itself grant the object’s required privilege.

For A-A, propose a function-attached path containing pg_catalog, the trusted report schema, then pg_temp. No untrusted role may create or replace relevant objects. Qualify application relations and review the other referenced objects; table qualification alone does not inventory the whole body.

The definer-function guidance places pg_temp last to prevent temporary-table shadowing. Its SET clause applies on entry and restores the prior value on exit; ordinary SET inside the body can override that containment. This fixed body therefore contains no setting changes.

Body form also matters: the reference distinguishes SQL string bodies parsed at execution from SQL-standard bodies parsed at definition. A-A selects the former. A changed form needs a new binding review; an attached runtime setting cannot be assumed to repair every creation-time reference.

Review new publication and replacement as different events

The built-in defaults grant PUBLIC execution on functions; configured default privileges can change them. The definer guidance recommends creating the function and restricting grants in one transaction to avoid an all-callers exposure window. A later revoke does not establish that no earlier call occurred.

For this proposed release, require supported evidence of the complete definition and intended effective grants being published together. This sheet supplies no transaction, deployment command or complete migration system. Unknown publication outcome stays unresolved; do not declare the helper private merely because a script was prepared.

CREATE OR REPLACE retains ownership and permissions, while other properties take their specified or implied values. Existing EXECUTE can therefore accompany a changed body or configuration. Re-review the complete A-A association before replacement admission. A familiar name, retained ACL or successful deployment status does not approve B-B.

Walk eight inert callable-admission cards

Keep this admission sheet smaller than a database safety claim

These sources do not inspect actual ownership, memberships, definitions, deployment timing or effective grants. Nor does this sheet establish a safe arbitrary function, a row-security boundary, end-user identity from an execution role, or a universal no-effect property. Unknown dependencies or wider execution paths require a separate review.

Keep minimized definition and decision references rather than report contents or credentials in ordinary evidence. Future database enforcement checks need independent authorization and their own actual results. Boundary is prelaunch and does not ship this function-admission service. Its synthetic action evidence concerns different behavior.