AI Agent 时代的数据库：Andy Pavlo 谈护栏、分支与 10-100 倍流量冲击Databases in the Age of Agents: Andy Pavlo on Guardrails, Branching, and 10-100x Query Volume
The Takeaway：当数十亿 AI Agent 同时读写数据库时，真正的风险不是技术能力，而是缺乏成熟的护栏和沙箱机制。
Carnegie Mellon 数据库教授 Andy Pavlo 近期加入 ClickHouse 创立 ClickHouse Labs。他指出，Agent 已从“查询向量数据库做 RAG”进化到直接创建、分支甚至删除数据库。Databricks 收购 Neon 后，Agent 创建的分支占比从 30% 飙升至 80%。分支本质是 copy-on-write 快照，让 Agent 在真实生产数据副本上试验 schema 与代码变更，而不污染主库。
Pavlo 把 Agent 比作“稍微聪明一点的幼儿”：“你不会把新学步的孩子放进没有护栏的楼梯口，也不会让他们把手指插进插座。”现有企业级数据库（尤其是商业遗留系统）早已具备权限、审计与只读控制，只需把这些能力暴露给 Agent 即可。文件即数据库，SQLite 比自己管理文件系统更安全。Postgres 几乎总是模型推荐的默认选择，因为训练数据里它出现得最多。
他预测 Agent 将带来 10 到 100 倍的查询量增长，因为它们 24/7 运行且可并行。查询模式可能更浅（少 join），但遥测数据本身又会成为新负载。LLMs 已能完成数据库系统作业的全部实现，开源数据库超过 60% 的 commit 已由 Agent 生成。自调优数据库用 LLM 可达到 85% 的效果，足够覆盖大多数场景。
“Every month, there's a story where someone lost their production database because the agent deleted something.” 历史教训早已存在，只是很多人选择重新发明轮子。
Carnegie Mellon 数据库教授 Andy Pavlo 近期加入 ClickHouse 创立 ClickHouse Labs。他指出，Agent 已从“查询向量数据库做 RAG”进化到直接创建、分支甚至删除数据库。Databricks 收购 Neon 后，Agent 创建的分支占比从 30% 飙升至 80%。分支本质是 copy-on-write 快照，让 Agent 在真实生产数据副本上试验 schema 与代码变更，而不污染主库。
Pavlo 把 Agent 比作“稍微聪明一点的幼儿”：“你不会把新学步的孩子放进没有护栏的楼梯口，也不会让他们把手指插进插座。”现有企业级数据库（尤其是商业遗留系统）早已具备权限、审计与只读控制，只需把这些能力暴露给 Agent 即可。文件即数据库，SQLite 比自己管理文件系统更安全。Postgres 几乎总是模型推荐的默认选择，因为训练数据里它出现得最多。
他预测 Agent 将带来 10 到 100 倍的查询量增长，因为它们 24/7 运行且可并行。查询模式可能更浅（少 join），但遥测数据本身又会成为新负载。LLMs 已能完成数据库系统作业的全部实现，开源数据库超过 60% 的 commit 已由 Agent 生成。自调优数据库用 LLM 可达到 85% 的效果，足够覆盖大多数场景。
“Every month, there's a story where someone lost their production database because the agent deleted something.” 历史教训早已存在，只是很多人选择重新发明轮子。
The Takeaway: When billions of AI agents start reading and writing databases, the real risk is not capability but the absence of mature guardrails and sandboxes.
Carnegie Mellon database professor Andy Pavlo recently joined ClickHouse to found ClickHouse Labs. He notes that agents have moved far beyond vector search and RAG: they now create, branch, and occasionally delete databases. After Databricks acquired Neon, the share of branches created by agents jumped from 30% to 80%. Branching is essentially a copy-on-write snapshot that lets an agent experiment with schema and code changes on a real production copy without touching the live system.
Pavlo compares agents to “slightly more sophisticated toddlers”: “You wouldn’t bring a new toddler and just not put up the guardrails so they don’t fall down the stairs.” Enterprise databases already have the permission, audit, and read-only controls needed; they simply need to be exposed to agents. A file system is a database. SQLite is safer than rolling your own durability. Postgres remains the default recommendation from models because it dominates the training data.
He expects a 10–100× increase in query volume as agents run 24/7 and in parallel. Query patterns may be shallower (fewer complex joins), yet agent telemetry itself becomes a new workload. LLMs can now implement entire database course projects, and more than 60% of commits in open-source database systems already come from agents. LLM-based auto-tuning reaches about 85% of optimal, which is good enough for most users.
“Every month, there's a story where someone lost their production database because the agent deleted something.” The controls have existed for decades; people keep reinventing the wheel.
查看原文 →
Carnegie Mellon database professor Andy Pavlo recently joined ClickHouse to found ClickHouse Labs. He notes that agents have moved far beyond vector search and RAG: they now create, branch, and occasionally delete databases. After Databricks acquired Neon, the share of branches created by agents jumped from 30% to 80%. Branching is essentially a copy-on-write snapshot that lets an agent experiment with schema and code changes on a real production copy without touching the live system.
Pavlo compares agents to “slightly more sophisticated toddlers”: “You wouldn’t bring a new toddler and just not put up the guardrails so they don’t fall down the stairs.” Enterprise databases already have the permission, audit, and read-only controls needed; they simply need to be exposed to agents. A file system is a database. SQLite is safer than rolling your own durability. Postgres remains the default recommendation from models because it dominates the training data.
He expects a 10–100× increase in query volume as agents run 24/7 and in parallel. Query patterns may be shallower (fewer complex joins), yet agent telemetry itself becomes a new workload. LLMs can now implement entire database course projects, and more than 60% of commits in open-source database systems already come from agents. LLM-based auto-tuning reaches about 85% of optimal, which is good enough for most users.
“Every month, there's a story where someone lost their production database because the agent deleted something.” The controls have existed for decades; people keep reinventing the wheel.