AI agents don’t need a sprawling stack to be useful. Datasette Agent shows how to let models run constrained, auditable SQL over your data—fast and transparent.
In a new write-up, Simon Willison outlines an approach he calls “Datasette Agent,” using Datasette (an open-source SQLite explorer) as the safe bridge between an LLM and your database.
What is “Datasette Agent”?
A lightweight pattern where an LLM gets a tiny toolbelt: list tables, inspect schemas, and run read-only, row-limited SQL via Datasette. Results come back as structured JSON/CSV the model can reason about.
The payoff: you keep data in SQLite, expose just enough capability for analysis, and preserve full visibility into every query the agent runs.
Why it matters
- Transparency: Every answer is backed by a visible SQL query.
- Safety by default: Read-only access, strict row limits, and timeouts reduce blast radius.
- Speed and portability: SQLite is fast, file-based, and easy to ship.
- Auditability: Log and replay queries for oversight and debugging.
- Minimal ops: Datasette can serve your DB locally or behind a small service.
Quick-start blueprint
- Prepare data: Put your tables in a SQLite database (or export CSVs to SQLite).
- Serve with Datasette: Run a local or private instance exposing read-only endpoints.
- Define tools: list_tables, describe_table, and run_sql (parameterized, with LIMIT and timeout).
- Set hard guards: Enforce SELECT-only, cap rows (e.g., 1,000), add a 10s timeout, and disable PRAGMA/DML.
- Prompt the agent: Ask it to state assumptions, show its SQL, and summarize results with citations.
- Evaluate: Compare agent answers to known queries; monitor latency and token costs.
- Productize: Wrap the agent behind an API with auth, rate limits, and query logging.
Security checklist
- Least privilege: Expose only necessary tables or create safe views.
- Mask sensitive fields: Hash, redact, or bucket PII before exposure.
- Prevent prompt injection: Strip HTML, constrain tools, and validate outputs (OWASP LLM Top 10).
- Cost and compute controls: Rate-limit queries; cap output size.
- Full audit trail: Log prompts, tool calls, SQL, and results (with sampling for large outputs).
Smart use cases
- Self-serve analytics Q&A over internal datasets.
- Instant data documentation: “Explain this table” and “example queries.”
- CSV clean-up copilots: Profile, dedupe, and validate incoming data.
- Operational monitors that summarize anomalies and link to the backing SQL.
- Notebook copilot that converts natural language to safe, reviewable SQL.
Key takeaway
Start small: give your agent a strict, read-only SQL tool against Datasette, log everything, and iterate. You’ll get reliable, explainable answers without heavy infra.
Subscribe for weekly, practical AI nuggets: theainuggets.com/newsletter
