[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83528-en":3,"doc-seo-83528-105":30,"detail-sidebar-cat-0-en-105":92},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},83528,962075006959,"Anda","https://ap-avatar.wpscdn.com/avatar/e0002397efbe92a78e?_k=1776741047341049297",8,"Research & Report","SessionBound：将企业任务批准转化为有预算的数据库会话","Enterprise AI agents support internal analysis, audit, and compliance review, yet authorization is difficult because agents may generate open-ended SQL below the application layer. SessionBound closes the gap by converting an approved enterprise task into a short-lived, budgeted, and auditable database session. A control plane manages task templates, applications, approvals, budgets, and signed task tokens, while SessionBoundDB enforces safe views, row scope, denied fields, operation limits, query/disclosure budgets, and receipts deterministically without relying on an LLM as a security oracle. A PostgreSQL prototype validates enforcement.","arXiv :2607 .0075 1v 1 [ cs .DB] 1 Jul 2026  \nSessionBound: Turning Enterprise Task Approval into Budgeted  \nDatabase Sessions  \nMinmin Wu  \nChina Telecom Global Limited  \nwuminmin@chinatelecomglobal . com  \nAbstract  \nEnterprise AI agents are useful for internal analysis, audit, compliance review, and operational investigation, but they create a difficult authorization problem. A manager or data owner may approve a business task, while the agent later generates open-ended SQL below the application layer. Existing systems help identify agents, delegate authority, govern data products, or enforce database policy, but they do not directly turn an approved enterprise task into a bounded database execution context. SessionBound fills this gap. It turns approved enterprise tasks into short-lived, budgeted, and auditable database sessions for AI agents. A control plane defines task templates, accepts task applications, records approvals, assigns budgets, and issues signed task tokens. A database runtime, SessionBoundDB, binds a token to a session and enforces safe views, row scope, denied fields, operation limits, query budgets, disclosure budgets, and receipts. The database does not rely on an LLM to decide whether a query is safe. The agent may generate SQL freely, but each attempt must stay inside the approved boundary. A PostgreSQL prototype passed a 24-scenario validation suite. Microbenchmarks show p50 SessionBound execution around 1.4–1.5 ms versus raw PostgreSQL p50 around 0.052–0.074 ms on small synthetic queries: high relative overhead, but low absolute latency.  \nCode availability. Code and evaluation artifacts are available at [https://github.com/SessionBound/](https://github.com/SessionBound/)  \nsessionbound.  \n1 Introduction  \nAI agents change how enterprise users interact with data. A user no longer needs to know which report exists, which dashboard to open, or which endpoint exposes a particular slice of operational data. The user can ask an agent to inspect travel reimbursements for one department, find unusual merchants, compare monthly totals, and drill into claims near approval thresholds. These tasks are temporary, exploratory, cross-table, and often under-specified. They are also the tasks for which a fixed SaaS screen is least likely to exist.  \nThe security problem is that exploratory SQL cannot simply be trusted to the agent. Giving an agent raw database access is unsafe. Prompting the agent not to inspect salary, bank, or unrelated department  \ndata is not a security boundary. Requiring a business approver to write row-level database policy for every temporary analysis is unrealistic. In real enterprises, people approve tasks, scopes, and budgets above the database. The database still needs a precise execution boundary below the application layer.  \nSessionBound is based on a simple principle: business users approve tasks, not database policies. Agents generate SQL, but databases enforce the approved boundary. A business approval becomes a signed task token. The token binds an agent, credential, task scope, safe views, denied fields, lifetime, operation limits, query budget, disclosure budget, and policy version. The database runtime consumes that token and creates a budgeted database session. The agent remains free to generate useful SQL, but every query attempt is checked deterministically.  \nThis paper presents SessionBound, a control-plane and database-runtime architecture for turning approved enterprise tasks into budgeted database sessions. It makes three contributions. First, it identifies enterprise task approval as the missing layer between agent delegation and database enforcement. Second, it proposes a control-plane and runtime architecture for turning approvals into budgeted database sessions. Third, it reports a PostgreSQL prototype that validates core enforcement behavior and measures smallquery overhead.  \n2 Motivation and Threat Model  \nEnterprise analytical work often starts with approval r","cbCairwZ1wAHQF2F","https://ap.wps.com/l/cbCairwZ1wAHQF2F","pdf",371613,5,1,7,"English","en",105,"# Introduction\n# Motivation and Threat Model","[{\"question\":\"SessionBound解决了什么授权难题？\",\"answer\":\"企业任务被批准后，代理在应用层以下生成开放式SQL，但现有方案缺少把“已批准任务”直接转化为“受限执行上下文”的机制。SessionBound将批准转成带预算与可审计边界的数据库会话。\"},{\"question\":\"控制平面在SessionBound中负责哪些工作？\",\"answer\":\"控制平面定义任务模板、接收任务申请、记录批准、分配预算，并为任务签发带约束信息的令牌（task token）。\"},{\"question\":\"数据库运行时如何在不依赖LLM安全判断的情况下限制SQL？\",\"answer\":\"SessionBoundDB将令牌绑定到会话，并以确定性方式强制执行安全视图、行范围、拒绝字段、操作与查询预算、披露预算以及收据等规则，从而确保每次SQL尝试都在已批准边界内。\"}]",1784188627,18,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":87,"head_meta":89,"extra_data":91,"updated_unix":28},"sessionbound-turning-enterprise-task-approval-into-budgeted-database-sessions","",{"@graph":36,"@context":86},[37,54,69],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/sessionbound-turning-enterprise-task-approval-into-budgeted-database-sessions/83528/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":24,"description":14,"dateModified":62,"datePublished":63,"encodingFormat":61,"isAccessibleForFree":64,"interactionStatistic":65},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-07-24","2026-07-16",true,{"@type":66,"interactionType":67,"userInteractionCount":20},"InteractionCounter",{"@type":68},"ViewAction",{"@type":70,"mainEntity":71},"FAQPage",[72,78,82],{"name":73,"@type":74,"acceptedAnswer":75},"SessionBound解决了什么授权难题？","Question",{"text":76,"@type":77},"企业任务被批准后，代理在应用层以下生成开放式SQL，但现有方案缺少把“已批准任务”直接转化为“受限执行上下文”的机制。SessionBound将批准转成带预算与可审计边界的数据库会话。","Answer",{"name":79,"@type":74,"acceptedAnswer":80},"控制平面在SessionBound中负责哪些工作？",{"text":81,"@type":77},"控制平面定义任务模板、接收任务申请、记录批准、分配预算，并为任务签发带约束信息的令牌（task token）。",{"name":83,"@type":74,"acceptedAnswer":84},"数据库运行时如何在不依赖LLM安全判断的情况下限制SQL？",{"text":85,"@type":77},"SessionBoundDB将令牌绑定到会话，并以确定性方式强制执行安全视图、行范围、拒绝字段、操作与查询预算、披露预算以及收据等规则，从而确保每次SQL尝试都在已批准边界内。","https://schema.org",{"og:url":52,"og:type":88,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":90,"canonical":52},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":93},[94,98,102,106,110,115,119,122,127,130,134],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":95,"show_sort_weight":96,"slug":97},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":99,"show_sort_weight":100,"slug":101},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":103,"show_sort_weight":104,"slug":105},"Exam",70,"exam",{"id":20,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":22,"doc_module":4,"doc_module_name":46,"category_name":116,"show_sort_weight":117,"slug":118},"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":120,"slug":121},30,"research-report",{"id":123,"doc_module":4,"doc_module_name":46,"category_name":124,"show_sort_weight":125,"slug":126},9,"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":46,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":131,"doc_module":4,"doc_module_name":46,"category_name":132,"show_sort_weight":131,"slug":133},10,"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":46,"category_name":136,"show_sort_weight":20,"slug":137},19,"General","general"]