Security Policy is a runtime enforcement policy, not documentation for what an agent should voluntarily do. The current policy is consumed by query/DML execution and runtime limiters.
2.0.1 policy fields
| Field | Default | Valid range / meaning |
|---|---|---|
QueryMaxRows | 1000 | 1–100,000 |
QueryTimeoutSeconds | 30 | 1–600 seconds |
RequireWhereForUpdate | true | require an UPDATE predicate |
RequireWhereForDelete | true | require a DELETE predicate |
AllowFullTableUpdate | false | explicit permission for full-table UPDATE |
AllowFullTableDelete | false | explicit permission for full-table DELETE |
DmlMaxAffectedRows | 100 | 1–1,000,000 |
KeyPermitLimit | 120 | 1–1,000,000 requests per configured key window |
KeyWindowSeconds | 60 | 1–86,400 seconds |
MaxConcurrentSql | 16 | 1–10,000 concurrent SQL operations |
The service rejects values outside these bounds instead of silently normalizing them into another policy.
Admin authorization
| Operation | Permission |
|---|---|
| read current policy | /runtime/security → view |
| update policy | /runtime/security → edit |
Updating the policy writes an audit event and immediately replaces the runtime policy state. The change is also published through the configured security-policy synchronization provider so a distributed deployment can propagate it across instances.
Query limits
QueryMaxRows bounds query output through the compiler/runtime policy. QueryTimeoutSeconds controls the runtime query timeout contract. These are server-side constraints and do not depend on a client remembering to add its own LIMIT or cancellation behavior.
UPDATE and DELETE predicates
The default policy requires predicates for UPDATE and DELETE and disallows full-table mutation.
Full-table allowance is explicit: turning off RequireWhereForUpdate does not by itself communicate the same intent as enabling AllowFullTableUpdate. Keep the conservative defaults unless the operational workflow genuinely needs broad mutation.
DML affected-row cap
DmlMaxAffectedRows bounds mutation impact. It complements—not replaces—the Safe DML approval protocol. A mutation still needs to parse/validate/compile successfully and, through MCP DML paths, complete the approval and commit-time revalidation flow.
See Safe DML.
MCP-key rate limits
The security policy supplies the default per-key permit limit/window. Individual MCP keys can:
- inherit the policy;
- use a custom override; or
- be explicitly unlimited.
See MCP Keys for the key-level mode.
SQL concurrency
MaxConcurrentSql is the runtime SQL concurrency limit. Whether that limit is process-local or coordinated across instances depends on the configured SQL concurrency provider.
For a cluster, use the distributed provider when the limit must represent the whole deployment rather than each node independently.