A live AI layer can make operational SQL useful to agents without making the system of record the agent workspace

RavenDB has launched Quill, a self-hosted layer that mirrors selected PostgreSQL, SQL Server, or MySQL data for AI agents while leaving the source database as the system of record.

Editorial read

This edition collects 1 notes across 1 topic areas and 1 source. Start with Agent access to operational SQL data is safer when a selected, observable mirror replaces direct access to the system of record to get the week's main practical signal before scanning the remaining links.

Edition signal

The September 16 signal is that an AI-ready data layer needs its own scope, freshness, and action controls

RavenDB's Quill is a practical example of separating an agent-facing context store from a production SQL system: it mirrors only selected tables into its own database and keeps that copy current through change data capture. This can reduce the need for agents to query or modify the system of record directly, but it creates a separate control surface. Teams still need to minimise the mirrored dataset, protect CDC and provider credentials, observe freshness and access, and treat any agent action outside the mirror as a separately authorised integration.

AgentsSecurity

Agents September 16 note

Official Quill documentation and product launch

Agent access to operational SQL data is safer when a selected, observable mirror replaces direct access to the system of record

Source: RavenDB

RavenDB has launched Quill for PostgreSQL, SQL Server, and MySQL. It runs in a Docker container beside the source system, reads only the tables an operator selects, and mirrors them into an internal RavenDB database that AI agents query. Quill uses each platform's change-recording capability to keep the mirror current; the source database remains the system of record and Quill documents the source connection as read-only. Agents can also be configured with separate actions that send requests to web endpoints.

Why this matters: A mirror is a useful boundary, not an automatic security outcome. Start with the smallest tables, columns, and rows needed for a concrete use case; review the privileges required for change capture and the treatment of deleted or stale records; protect the LLM and database credentials; and monitor replication lag. Keep write-capable actions out of the data path by default, then give each action a named owner, constrained endpoint, approval rule, audit trail, and revoke path. That makes the agent's context layer easier to govern than broad production-database access.

Read RavenDB's Quill architecture overview