The execution boundary for production databases.

AI: Let me check which users haven't
    logged in since January.

→ tool: dbward_execute_query
  database: primary
  environment: production
  sql: "SELECT id, email, last_login
        FROM users
        WHERE last_login < '2026-01-01'"

⚠ Request a3c1 requires approval.
  — waiting for human approval —

✓ 1,204 rows returned (31ms)
AI: Found 1,204 inactive users.

$ dbward request list --pending-for-me
  a3c1 SELECT id, email... @alice

$ dbward request show a3c1
Request a3c1
  Status:      pending
  Detail:      SELECT id, email, last_login
               FROM users WHERE last_login ...

  Risk:        low
  SQL Review:  passed
  Explain:     Index Scan on idx_users_login
               rows=1204 cost=0.42..892

$ dbward request approve a3c1 \
  --comment "LGTM"
Approved step 1/1

# Staging: auto-approve low-risk queries

[[auto_approve]]
database = "*"
environment = "staging"
risk = "low"
allow_read_only = true
allow_safe_ddl = true

# Development: auto-approve everything

[[auto_approve]]
database = "*"
environment = "development"
risk = "high"

# Production: no [[auto_approve]] entry
# → all requests require human approval

$ dbward -e staging execute \
  "SELECT id, name, email
   FROM users WHERE active = true"

 id | name     | email
----+----------+---------------------
  1 | Alice    | alice@example.com
  2 | Bob      | bob@example.com
  3 | Carol    | carol@example.com
  … |          |
(2341 rows)

-- migrate:up
CREATE TABLE orders (
    id SERIAL PRIMARY KEY,
    user_id INTEGER REFERENCES users(id),
    status TEXT NOT NULL
      DEFAULT 'pending',
    total_cents INTEGER NOT NULL,
    created_at TIMESTAMPTZ
      DEFAULT now()
);

-- migrate:down
DROP TABLE orders;

$ dbward migrate status

 version                    | status
----------------------------+---------
 20260501_create_users      | applied
 20260502_add_email_index   | applied
 20260503_create_orders     | pending
(3 rows)

$ dbward migrate up
Request m1a2 requires approval.
  Approvers: dba-team
Run: dbward request resume m1a2

# After approval...
$ dbward request resume m1a2
Waiting for agent to execute...
Applied migrations:
  ✓ 20260503_create_orders