Row-Level Security for AI Agents

Google Cloud AI Research published EnvHarness ten days ago [1]. It solves an agent training problem with a mechanism I already knew from database work.

Agents learn by acting in environments, and those environments are hand-built and frozen. Once an agent solves a task, there is nothing left to learn there.

EnvHarness wraps that environment in a layer that rewrites what crosses the interface. Its Contract component controls which actions are allowed, what the agent sees, and which state changes go through. The environment underneath is never modified.

A row-level security policy does the same. It sits between the client and the table, where USING decides which rows are visible and WITH CHECK decides which writes land [2]. The table never changes.

I also wrote 37 such policies across a nine-table schema during my time at Honda Research Institute USA. The child tables proved ownership through the session root rather than copying a user column that could drift.

Our server connected through a service-role client, which bypasses RLS. On that path the policies never ran, so authorization had to live in the API handlers, and five of them were missing the check.

The paper never has to say this, because the agent has one way in, reset and step. Everything it does passes through the Contract. My schema had the same shape and a second door beside it.

---

References

[1] C. Huang et al., “EnvHarness: Awakening Static Worlds for Agent Learning,” arXiv preprint arXiv

.19880, Aug. 20, 2026. [Online]. Available: https://arxiv.org/abs/2608.19880.

[2] The PostgreSQL Global Development Group, “Row Security Policies,” PostgreSQL 18 Documentation, Aug. 13, 2026. [Online]. Available: https://www.postgresql.org/docs/current/ddl-rowsecurity.html.