AgentHippo
The Alice/Bob Test
Ask your agent as Alice.
Then ask again as Bob.
Same question. If Bob gets Alice's data, you're one prompt injection from a breach — and most agents fail, because they log into the database as one account that reads everything. AgentHippo agents pass: your own database enforces who sees what, and we prove it on your data before anything ships.
› Why it passes here — and fails everywhere the prompt does the guarding
A permission paragraph in a prompt can be talked out of anything. Here, the query itself runs with the asking user's authority — so there's nothing to talk the agent out of.
The agent never holds a credential
No database password, no API key in the agent's environment. Each turn, the agent gets a token that lives only for that turn — and the credential itself stays in a separate, isolated process. Steal the whole agent and there is nothing durable to take.
Your database does the enforcing
Not middleware, not a proxy policy, not the prompt. Postgres Row-Level Security, AWS IAM session tags on DynamoDB, or Databricks Unity Catalog decides what each query may touch — the same controls your security team already trusts for humans.
User × agent, intersected
The invoice agent gets its own narrow grants, separate from the user's. So an injected invoice agent inside an HR admin's session still can't read the salaries table — even though the admin personally could — because this agent was never granted a path to it.
Zero permission language in the prompt
Our Databricks reference agent contains no access-control instructions at all — and still returns the right rows per user. That's a stronger claim than a carefully-worded prompt, because there's nothing for an attacker to argue with.
› Works on the databases you already have
Plain Postgres
No special features needed. Row-Level Security plus per-turn role selection means a pooled connection can never leak one user's identity into another's query. Live-tested end to end.
Amazon DynamoDB
Per-user rows enforced by AWS IAM itself — short-lived credentials tagged with the user, scoped to their keys. Verified live, adjudicated by AWS policy evaluation.
Databricks
The platform's own on-behalf-of tokens pass through untouched, so Unity Catalog row filters and column masks apply per user — your existing governance, unchanged.
Two users, one agent, different rows — verified by scripts on every deploy, not asserted in a slide. The deployment blueprints are plain, auditable bash you can read before running.
› Go deeper
Also: cap what they spend
Hard spend limits and an off switch for the agents you already have — adopt in an afternoon.
Evidence & compliance
Who asked, which signed version ran, what it touched, what it cost — a tamper-evident record in your storage, exportable in minutes for an audit.
Prove it on your data
The Production Sprint runs the Alice/Bob test against your own database — passing it is the acceptance criterion.
Run the Alice/Bob test on your own data.
The Production Sprint puts one real workflow on per-user permissions in three weeks — with the test passing against your database as the acceptance criterion.