-
Notifications
You must be signed in to change notification settings - Fork 0
Governance Model
江河 edited this page Jul 1, 2026
·
2 revisions
dbgov classifies operations into R0-R3 risk tiers. The tool's measured plan is authoritative; AI agents must not infer blast radius on their own.
| Tier | Meaning | Required Authorization |
|---|---|---|
| R0 | Reads and inspection: query, explain, schema list/describe/dump/diff/plan, audit query/verify, doctor |
None, but audited |
| R1 | Small safe writes |
--yes or interactive confirmation |
| R2 | Elevated writes or protected-context R1 |
--yes and non-empty --ticket
|
| R3 | Destructive operations | R2 authorization plus the precise --allow-* flag |
| Operation | Required Flag |
|---|---|
| Destructive schema apply/import | --allow-destructive |
| No-WHERE update/delete | --allow-no-where |
| Reconcile prune | --allow-production-prune |
| Destructive rollback |
--allow-destructive and/or --allow-production-prune
|
- Run
capabilities -o jsonbefore assuming available features. - Use
-o jsonfor integration paths. - Use
explain,schema plan, and--dry-runas the source of impact. - Stop and ask a human when a command requires ticket, allow flag, or high-risk confirmation.