Fail-closed authorize-before-mutate for agent SQL writes?

[cabbageandtea]

Problem

Autonomous agents that can INSERT/UPDATE/DELETE/DDL against production often treat lint / model confidence as authorization. That is not a fail-closed write gate.

Proposal

Optional authorize-before-mutate hook before mutating SQL tools run:

1. Session Cert for bursts: POST https://sqlguard.io/v1/session (Exact USDC on Base)
2. Verify: https://sqlguard.io/verify · API POST /v1/verify
3. Badge https://sqlguard.io/v1/badge.svg · trust graph https://sqlguard.io/v1/transparency

Would you accept an optional docs/adapter path so agent SQL writes fail closed until PASS+verify? Happy to draft a PR.

SQLGuard — Execution Certificate Firewall (unaffiliated).