An approach that converts natural language questions into SQL queries against structured databases. It lets non-technical users ask business questions in plain language while the system generates database commands. Security teams should govern it carefully because it can expose sensitive records if permissions and query boundaries are too broad.
Expanded Definition
Text-to-SQL is a natural language interface that translates business questions into SQL against structured data stores, often through an agent or application layer that selects tables, builds predicates, and executes the resulting query. In NHI and IAM environments, the security question is not whether the query is syntactically valid, but whether the generated SQL is constrained by identity, authorization, and data minimization. Definitions vary across vendors when text-to-SQL is bundled with chatbots, semantic layers, or agentic workflows, so NHI Management Group treats it as a privileged data-access capability rather than a simple user experience feature. That distinction matters because the model, orchestration service, and database connector each become part of the trust boundary. A useful implementation reference is the NIST Cybersecurity Framework 2.0, especially where access control and data protection are operationalised across the stack. The most common misapplication is allowing free-form prompts to reach production data sources without row-level controls, which occurs when teams mistake natural language input for a safe abstraction layer.
Examples and Use Cases
Implementing text-to-SQL rigorously often introduces latency, review overhead, and query-guardrail complexity, requiring organisations to weigh usability against the risk of overbroad data exposure.
- A finance analyst asks for monthly revenue by region, and the system generates a read-only query with approved views instead of direct table access.
- An internal support agent queries customer case trends, while policy enforcement blocks joins that would expose payment or identity fields.
- A security team tests a model that can draft SQL, then uses the SAP SQL Anywhere Monitor Hardcoded Credentials case to illustrate how weak secret handling can turn database access paths into breach paths.
- A data product exposes natural language reporting through a governed semantic layer, with database access scoped to service accounts and audited for each query.
- A chatbot connected to operational metrics uses NIST Cybersecurity Framework 2.0 aligned controls to separate prompt handling from execution authority.
Why It Matters in NHI Security
Text-to-SQL becomes an NHI issue because the system generating SQL usually runs with persistent credentials, API keys, or service accounts that can read far more than a human user should see. NHI Management Group research shows that 97% of NHIs carry excessive privileges, which means a text-to-SQL connector can quickly become a high-impact access path if permissions are not tightly scoped. That risk is amplified when secrets are embedded in application code, copied into orchestration layers, or reused across analytics tools and agent frameworks. The right governance model treats the text-to-SQL service as an NHI that needs inventory, rotation, monitoring, and offboarding discipline, not just application testing. The broader lesson is visible in incidents like SAP SQL Anywhere Monitor Hardcoded Credentials, where unsafe credential handling made access paths difficult to contain. Organisations typically encounter the true impact only after a prompt or connector leaks sensitive records, at which point query governance becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Covers improper secret and credential handling for non-human access paths. |
| NIST CSF 2.0 | PR.AC-4 | Maps to least-privilege access control and entitlement governance. |
| NIST Zero Trust (SP 800-207) | SC-7 | Zero Trust requires continuous policy enforcement at data access boundaries. |
| NIST AI RMF | Addresses AI system risk management, including unsafe outputs and misuse. | |
| OWASP Agentic AI Top 10 | A9 | Agentic workflows can execute high-impact actions through generated tool calls. |
Treat every generated query as untrusted until identity, context, and policy checks pass.
Related resources from NHI Mgmt Group
- When do structured questions work better than free text in agentic workflows?
- Why do agentic AI prompts need stronger controls than ordinary text inputs?
- How can teams decide whether to use SQL or natural-language-style tools for agents?
- How should security teams govern applications whose identity data only exists in SQL tables?
