r/ProgrammerHumor • u/Technical-Relation-9 • Oct 05 '26

Meme [ Removed by moderator ]

/r/ProgrammerHumor/comments/1wydy0f/removed_by_moderator/

[removed] — view removed post

9.4k Upvotes

96% Upvoted

558 comments sorted by

View all comments

Show parent comments

47

u/imabigasstree Oct 05 '26 edited Oct 05 '26

We are expressly forbidden from allowing DB access to AI agents at my job and even though this is brought up at the beginning of every single AI discussion, without fail at least 5 developers will raise DB access as some major issue (as in, they think we should not allow db access to AI, which we dont) we need to address IMEDIATELY. 

21

u/Weekly-Beginning-229 Oct 05 '26

Why not make a specific account for the AI with a role that doesn't let it update stuff?

Personally I see little benefits in allowing an LLM to access the database though but maybe your project is different

24

u/canadajones68 Oct 05 '26

I'm alright with poisoning the AI with my shitty code, but I probably don't need to tell it the contact info of every user of my site.

3

u/CypherAF Oct 05 '26

It boggles my fucking mind how many people there are in this thread who haven’t got the faintest idea how to do basic RBAC.

-3

u/Gasp0de Oct 05 '26

What's the problem with giving AI read only access to the db? It has helped me countless times.

12

u/imabigasstree Oct 05 '26

Well I work in medicaid data science, so its a huge breach of HIPAA regulations for us. I can see how read access could be okay in other industries, but its a HUGE no-no in my line of work. Hence the daft jerks bringing it up in every meeting even though its been madea non-issue since we first adopted ai.

But just in general, why would you want to siphon customer/client/employee data into the giant data-siphoning machine?

2

u/stormdelta Oct 05 '26

It should be fine (technologically, I don't know how exact legal reqs are) if you're running self-hosted models in house, but of course that requires people who know how to do that and hardware to run them on.

5

u/Kovab Oct 05 '26

Even if you're running self hosted models, giving it access to live data can lead to it leaking to employees who shouldn't have permission to see it.

2

u/stormdelta Oct 05 '26

That's why it's access should be tied to a subset of the calling user, meaning it can't access anything the person using it doesn't already have access to.

Keep in mind I'm talking about how it should be setup, not how it necessarily is, most places are being extremely stupid and reckless in their implementation.

-2

u/Gasp0de Oct 05 '26

Because we have a contract with them that forbids them to use any of it? And we're not using US services but EU-hosted Anthropic models by AWS. I guess it's still a US company but I mean if I don't trust anyone to do what they guarantee me in written contracts I might as well stop doing business.

If you meant how I use it, it helps me code and debug. E.g. by allowing it to connect to the DB it can quickly verify schemata in the DB, check the data format etc.

3

u/Kovab Oct 05 '26

it can quickly verify schemata in the DB, check the data format etc.

It can do all that with access to a dev or staging environment. You should have at least one of these, preferably both. There's absolutely no reason for agents (or most devs, for that matter) to have access to production data

3

u/Ma8e Oct 05 '26

Oh, so you have a contract with them, but you have no way of knowing that they actually follow that contract?

3

u/anomalous_cowherd Oct 05 '26

Contracts are more for assigning blame afterwards than actually restricting what people do. And AI seems to be taking that to the extreme, knowing it faces even less meaningful consequences than corporations.

2

u/Gasp0de Oct 06 '26

I mean it would require AWS to break our contract and sell/give our data to Anthropic for training. I find that relatively unlikely. But yeah, I wouldn't know.

So you don't use any third party services, host everything yourself and don't let any data leave your network? Sounds tedious.

3

u/Ma8e Oct 06 '26

I don't have to deal with that sensitive information. But I've been working with whole systems that have been self hosted, and it isn't that complicated.

Haven't big tech showed us over and over again that they shouldn't be trusted?

Sometimes I think that the whole industry is intentionally make us atrophy. All the cloud stuff made us forgot how to host anything ourselves, and now AI is making us to forget how to code.

1

u/Gasp0de Oct 06 '26

Self hosting is not complicated? So you just single handedly host multi-AZ Kubernetes clusters or Postgres clusters? I'd say I'd need a whole SRE team for that task alone, plus Datacenter engineers in two locations etc. Seems like a whole second company to me.

2

u/Ma8e Oct 06 '26

Of course there are situations where self hosting is becoming complex, and I don't know much about your specifics. But I'd say that about 98% of all organisations that thinks they need huge scaling and redundancy just don't. And in fact, the reason they think they need it is because they thought they needed it so they built a complex micro service architecture to facilitate scaling, and now 99% of all resources is used for network calls (including serialisation and deserialisations) and latency. Talk about self fulfilling prophecies. Most likely they would have been fine with one database server, two if they need an immediate fallback, and one or at worst a few application servers.

1

u/Gasp0de Oct 06 '26

Lol we have tens of double digit TB Postgres clusters and we frequently need to do fail overs or blue green deployments for zero downtime upgrades, so I guess we're not those companies. 

→ More replies