Midplane sits in front of your Postgres and decides what each query can do — parser-level, audited, denied before it runs.
Or talk to us · design partner program →
The same SQL your engineer's agent might run on a Tuesday morning, with and without midplane in front of Postgres. One deletes prod. One leaks every customer — and looks like a normal read.
# cursor agent, cleaning up stale rows
WITH cleanup AS (
DELETE FROM users
RETURNING *
)
SELECT count(*) FROM cleanup;# same agent, same query
WITH cleanup AS (
DELETE FROM users
RETURNING *
)
SELECT count(*) FROM cleanup;# cursor agent: “list recent signups”
SELECT email, plan FROM users
ORDER BY created_at DESC
LIMIT 50;# same agent, same query
SELECT email, plan FROM users
ORDER BY created_at DESC
LIMIT 50;A read-only role would have allowed this — it's a SELECT. tenant_scope is the one rule a database role can't give you.
Pick an example. Flip a table's access level. Re-pick to watch the decision change.
Click below. Edit the table access on the right. Re-click to see the decision flip.
Awaiting first event.
You hand the agent a Midplane URL once. From then on, every query the agent runs is checked, logged, then executed against your Postgres — or returned as a clean deny the agent can recover from.
table_access · allow tenant_scope · allow multi_stmt · deny ddl · deny
Read-only default, writes per opt-in table, tenant predicate required.
audit_log ← who = lena@acme agent = claude-code table = users stage = ATTEMPTED committed
Written before Postgres sees the query. Log failure rejects the query.
allow → postgres └ 25 rows · 4.1 ms deny → structured reply └ reason: table_access └ agent pivots
Allowed queries run normally. Denied queries return a parsable error — no half-writes.
Default access in one click. Per-table overrides for the few that need write. Tenant scope on or off, with a column you control. Saved policy reaches the engine in milliseconds — no agent restart, no DSN reshuffle.
Schema-qualified entries (stripe.charges) win over bare names. Saves push to the engine over the admin channel; the agent's active MCP session keeps running.
Enforced at the parser. Not configurable, not in the editor.
Append-only. Filterable by agent, table, tenant, decision. Every row records the MCP client and the agent's declared intent — and for changes you make in the dashboard, the engineer who made them. So six months later you can ask “what was claude-code trying to do?” or “who flipped that flag?”
Policy enforcement, audit log, and tenant isolation are on every tier. Tiers gate structural growth — more connections, more seats, longer retention, enterprise SSO. Query volume is never metered. Hosted in EU or US, or self-host the MIT-licensed engine — same engine and audit format either way.