# Query Gate

> Check a SaaS product's plan to give customers live SQL to their own data - a warehouse share, a read endpoint or a
> JDBC/ODBC handle a BI tool connects to - before the first customer connects. List the views you would expose, the
> compute handles behind them and the planned schema changes, and answer a short interview; the browser ranks the
> architecture by scan economics, audits every view for engine-level isolation and every handle for cost caps, and
> checks the schema contract, credentials and price. Metered runs write the access blueprint, and the customer
> contract with connection pages. Built on the SkillSafe skill @samber/sql-jdbc-access-design, from
> samber/developer-platform-skills (MIT), by Samuel Berthe.
> A review aid, not a security guarantee: passing the checks means the plan as described passes them; the live
> deployment still needs the isolation probe and a security review.

https://query-gate.skillsafe.ai/

## What is free
- The architecture: a zero-copy warehouse share, a replicated copy or read endpoint, or per-tenant compute isolation, ranked by where the data lives and how often customers scan it - an OLTP-only stack has no share rung; about 20 scans a day on a 200 GB table favours a copy; arbitrary customer SQL at agent frequency across many tenants favours per-tenant engines.
- Isolation: every view checked for an engine policy (secure or dynamic view, or row-level security with FORCE), a share-aware identity instead of CURRENT_ROLE or CURRENT_USER, no application WHERE filter, no partition filter as access control, and a probe run as another tenant.
- The schema and the caps: a curated mart under an additive-only contract enforced in CI, with in-place renames, retypes and drops flagged; a statement timeout, a concurrency cap and a spend cap on every compute handle, with provider-paid compute flagged when uncapped.
- Connectivity, credentials and price: a Postgres wire endpoint over your own driver or a custom dialect; short-lived tokens over passwords; a tier, add-on or meter, never free. Plus an isolation probe script, a caps CSV, the checks (.csv) and everything (.json).

## The metered lanes
Two tasks on gpt-terra, metered per run, routed by `task`. Input string fields: `task` (blueprint or contract), `product`, `surface`, `carry` (contract only: the blueprint's decisions) and `facts`.
- `blueprint` replies with `summary`, `problem`, `architecture`, `isolation`, `schema`, `connectivity`, `governance`, `credentials`, `pricing` and `caveats`.
- `contract` replies with `summary`, `contract`, `breaking`, `changes`, `pages` and `caveats`.
The page holds every reply to its own facts: the ranked rung with its promotion condition, an engine policy, the right identity and a probe for every view, three caps for every handle, the connectivity rung, tokens first and the ranked price; a four-part contract, every planned breaking change staged as add, deprecate, migrate, remove, and one connection page per client with TLS required and no credential in any URL.

## Links
- API tutorial: https://query-gate.skillsafe.ai/api.html
- Source skill: https://skillsafe.ai/skill/@samber/sql-jdbc-access-design