Limit the Blast Radius

You still need DBAs (that know how to back up systems and test restores). If you think you don’t, or if you manager does, then perhaps they ought to read this piece on how an AI agent deleted a production database. This wasn’t the case of an agent just running around with sysadmin access to all resources, or a lack of tests that allowed bad code to flow through a CI/CD process.

This was a system design that had a hole in it. An API call to change infrastructure that could change both staging and production. Not something an AI set up, but humans did. A hole from both PocketOS and the API vendor that allowed the AI agent to make the same type of mistake we’ve seen humans make. A mistake of not double checking, not verifying, not following the rules of getting a second set of eyes, even a second set of virtual eyes, on the code that could drop resources.

Reading this, I can imagine this is how some of the AWS and Azure outages occurred over the last decade. Not the 2025/2026 AI inspired ones, but the 2010-2015 human mistakes that didn’t expect a change to have such a far reaching blast radius,

You still need guardrails, for both humans and AIs. Don’t get slack and assume either truly knows what they are doing and deserves rights everywhere. Don’t assume that your guardrails were setup correctly. AI agents make great helpers. Use some read only ones to examine your setup and look for holes. If/When we get the next Claude Mythos model (or the equivalents from Google/OpenAI/etc.) have it look for precisely the types of holes that come from bad code that looks to reset, redeploy, or re-anything in your environment.

We separate out roles for different people to limit the blast radius of the mistakes we inevitably make. AIs aren’t necessarily smarter or better than humans. Just faster. We need separate roles, separate rights, and governance for AI agents, precisely because they can make decisions faster than humans.

There’s tremendous potential, but and tremendous danger in allowing anyone, or anything, too many rights in any organizations. RBAC, audits, and all the other things we implement to try and reduce the number of silly mistakes are still needed. At some point we’re going to see amazing social engineered emails, messages, XSS, and other items that are designed to fool the AIs just like humans have been fooled in the past.

We need to ensure we set good guardrails and limits when that starts to happen. Or we’re going to lose control much quicker than expected.

PS If you want a fun and slightly scary read on how AI could go sideways, I enjoyed The Final System recently, which made me not want to deploy any sort of AI agent beyond tightly scoped ones with very, very limited rights.

Steve Jones

Listen to the podcast at Libsyn, Spotify, or iTunes.

Note, podcasts are only available for a limited time online.

Posted in Editorial | Tagged , , | Leave a comment

QUOTENAME Basics: #SQLNewBlogger

Recently I ran across some code that used a lot of QUOTENAME() calls. A colleague was having some trouble with the code, but what struck me was that I hadn’t often delved into the details of QUOTENAME and how it can be used in different ways. I’d always just passed in a string as a single parameter.

This post looks at a few details of how this function works.

Another post for me that is simple and hopefully serves as an example for people trying to get blogging as #SQLNewBloggers.

QUOTENAME

The idea behind QUOTENAME() is that you pass in a string that might not be properly formatted to be an indentifier. QUOTENAME() returns the string with enclosing characters that ensure the string works in your code as a literal.

Here’s an example. If I have a string that is “Steve Jones”, I’ve quoted the string with double quotes. If I wanted to create a table with this string, I’d do this:

CREATE TABLE dbo.[Steve Jones] (id int);

I’ve explicitly put brackets around the string, which is what we commonly do in SQL Server if we have some reserved word or space we want in the object name.

NOTE: I am not recommending this, just showing this as an example.

If I were doing this in code, and maybe I wanted to dynamically create this table, I’d do this:

DECLARE @n nvarchar(20) = N'Steve Jones';
DECLARE @s nVARCHAR(100) 

SELECT @s = 'create table dbo.' + QUOTENAME(@n) + '(id int)'

EXEC(@s)

When QUOTENAME runs, by default, it will surround the string with brackets. You can see this in the results below.

2026-05_0281

This is a valid identifier, and we end up with a table that has a space in it’s name, which I abhor. But it works.

A Second Parameter

While this is how I’ve used QUOTENAME in the past, usually to clean up strings that might be reserved words, like name, there actually is an optional second parameter. The syntax for QUOTENAME is:

QUOTENAME ( string, [ character])

where

  • string – the string that you need to quote
  • character – a single character that represents the delimiters to be used to surround the string.

One might think that any character can be used, but that’s not true. Only a few characters are supported. The list is:

  • brackets, [], which is the default
  • braces, {}
  • single quotes, ‘
  • double quotes, “
  • angle brackets, <>

That’s it. Anything else produces not an error but a NULL, as shown here:

2026-05_0282

What’s interesting is that the parameter is a single character, but the function works out what the matching character should be. For single and double quotes, this is easy. The same character is used, as you can see below. Note the single quote is escaped.

2026-05_0283

For brackets, if I use either the left or right bracket, the result has a left bracket on the left side and a right bracket on the right side. You can see that below.

2026-05_0284

Same thing for braces.

2026-05_0285

And angle brackets.

2026-05_0286

What’s what I’d expect, but it’s nice to know it works. This limits flexibility for the function, and if I were designing it, I might make the second parameter two characters that represent the left and right enclosures. Or make a separate parameter for each. That would allow me to do something like:

SELECT QUOTENAME(‘Steve Jones’, ‘_>’ )

and get

_Steve Jones>

I could have run with a space at the beginning and a comma or period at the end, helping me clean up text. Winking smile

SQL New Blogger

This is a quick post that I actually spent about 10 minutes on during a flight. I had run into this while answering a friend and reading the docs, so I left a quick sentence as a reminder and then fleshed out this post. I spent another 10 minutes once I landed (and got plugged in) capturing the screen shots.

This is a good example of showing how I dug into a feature of SQL Server, I understand how it works, show how it can be used, and how I might have wished it would be used.

You could do this in a half hour at a coffee shop and start knowing that you can learn a few things and maybe show how you’d evaluate if this was needed in AI generated code, some of which you might see in the very near future.

Posted in Blog | Tagged , , | Leave a comment

What Can AI Really Do?

I wonder how many of you have tried vibe coding something with an AI tool. If you haven’t, I certainly recommend it. I’ve been a bit amazed with a few of my AI Experiments, including my loading of a lot of inconsistently formatted data into a database for USD$5.

To be clear, there’s plenty of vibe coding that might not be production-ready, but have you ever been handed code from a human developer you didn’t think was production-ready? Or deployed code like that? Certainly, AI could exacerbate the situation, but it can also spark ideas, ease (and speed) development in small ways, and tackle the backlog of things your org needs.

Especially small tools.

How big a concern or help will this be? I ran across an interesting article from a semi-technical person trying to build a text analysis tool. This is the type of thing we may do as database pros, but we wouldn’t have time to service every request for this assistance. There is a mixed bag of success in the piece, and a recognition that software developers have skills and knowledge that AI tools can’t necessarily duplicate in the hands of a non-pro.

However, that’s where I think software engineers and database professionals have to learn to leverage AI tools to become more efficient, prove their worth, and, honestly, get more done without working longer hours. It’s also a place where you might guide users in producing some useful, but less mission critical software for themselves with AI. That might lower the number of requests I get.

To me, that’s the direction I want to go with AI. More productive, less stress, and the same (or fewer) hours.

What do you think AI can do for you? Let us know today.

Steve Jones

Listen to the podcast at Libsyn, Spotify, or iTunes.

Note, podcasts are only available for a limited time online.

Posted in Editorial | Tagged | Leave a comment

Breaking Rules in Rome

Last week I was honored with a trip to Rome for the Redgate President’s Club. I was awarded this, along with our top people in Sales, for the work I did in 2025. It was a fun trip, but as we prepared to depart Cambridge, one of the rules our Chief Revenue Officer gave us was:

Don’t work this week

She told us that the company should be able to survive a week without us. On Wednesday, I got reminded of this when I replied to a few Slack messages.

Thursday I got reminded again.

By Friday she had given up.

It’s not that I don’t want to get away from work, or don’t, but there are things that come up and can be easily dealt with. In both cases, I had people ping me about things that are happening this week (18May) or in two weeks (1 Jun), and I need to ensure I’m prepped. I also had responses on a couple of SQL Server Central tickets, that I needed to provide a few details on.

These were small things, and I wasn’t checking email or most Slack messages, only a few channels where I knew there would be some relevant activity. I also scanned email looking for only ticket responses so I could provide info if needed.

Sometimes work takes priority over other things. I’ve had to handle a few things on sabbaticals. I’ve had to respond on vacation for certain things. In general I tell people to leave me alone, and they do for the most part.

I’m not upset, and it’s the price of being successful and involved. Finding this balance is important, and it’s easy to work too much, or too little. I feel I’ve got a pretty good balance when I go on vacation, minimizing interruptions, though certainly not eliminating them.

That being said, I did have a good time. Not sure why I’m not smiling, but the Colosseum was amazing.

20260515_182019

Posted in Blog | Tagged , | 2 Comments