Data permissions your AI agent can't talk its way past.
Row-level security enforced server side, before any query runs. Set rules from user and org properties, test them as any user, and deploy one agent to every tenant. The agent never sees the rules, so it can't bypass them.
New · Launch Month day 2, Thu 1 Oct 2026 · Upvote on Product Hunt →
"The prompt tells it not to" is not a security model.
Agents that enforce their own permissions can be confused, prompt-injected or simply wrong.
Multi-tenant SaaS can't put an agent in front of customers without hard data isolation.
Security reviews stall AI projects when nobody can show exactly what each user can see.
From setup to production in three steps
Register orgs and users
Give organisations and users properties such as country, tenant or role.
Write rules once
Global rules like column country = user.country apply to every table that has the column. Custom SQL rules cover the rest.
Test as anyone
Preview any query as any user and see the exact WHERE clause Upsolve will apply before it runs.
What changes with Upsolve Row-Level Security
The agent is told in its prompt not to show other tenants' data, and you hope it listens.
Every query is pre-filtered on the server from user properties before it runs. The agent never sees the rules.
Everything that ships with Row-Level Security
Server-side pre-filters
Every query, whether an agent or a person wrote it, is filtered before it reaches your database.
Invisible to the agent
Rules live outside the agent's context, keeping deterministic security separate from agentic workflows.
Optional or required
Choose whether a missing property skips the rule or blocks the data entirely.
Built for multi-tenant
One agent, deployed to thousands of customers, each seeing only their own rows.
One layer of a closed learning loop
Upsolve builds the whole stack for data agents that stay accurate in production. Every conversation feeds the next improvement.
Part of Upsolve Launch Month
Common questions
No. Rules are applied server side as pre-filters on every query, and the agent never sees them.
Write a custom SQL rule for that table. Upsolve reads the user property and applies your SQL before anything runs.
Yes. Live views on shared canvases re-run under the viewer's own permissions.
Can't find your answer? Get in touch.