AI + warehouse case study
Ask a plain-English finance or operations question, run read-only SQL against a trusted warehouse through tool calling, and answer from the actual rows queried.
Business question
This project continues BudgetDB: the warehouse provides trusted raw-to-fact data, and Chat With Your Data adds a conversational layer with schema-grounded tool use, SQL safety checks, and auditable database reads.
Chat With Your Data snippets
1def is_safe_select(sql: str) -> bool:2 stripped = sql.strip().rstrip(";")3 if not re.match(r"^\s*(SELECT|WITH)\b", stripped, re.I):4 return False5 if _FORBIDDEN.search(stripped):6 return False7 if ";" in stripped:8 return False9 return True101112def run_sql_query(sql: str) -> dict:13 if not is_safe_select(sql):14 return {"error": "Refused: only a single read-only SELECT/WITH statement is permitted."}1516 conn = sqlite3.connect(f"file:{DB_PATH}?mode=ro", uri=True)17 conn.row_factory = sqlite3.Row18 rows = conn.execute(sql).fetchall()19 conn.close()20 return {"rows": [dict(r) for r in rows][:200]}How it works
The system gives the AI controlled context and one controlled capability: query the warehouse safely.
Claude receives the warehouse schema, table meanings, and guidance on which tables to prefer for finance and workforce questions.
The model has exactly one tool, run_sql_query. It chooses SQL, receives real rows, and can run follow-up queries inside a capped agentic loop.
The final response is written in plain English and grounded in the actual rows returned from the database, not a guessed summary.
Safety model
For finance and operations data, the system cannot rely on prompt instructions alone. The tool uses application-level allowlisting and database-level read-only enforcement.
Generated SQL must start with SELECT or WITH, cannot contain mutating statements, and cannot stack multiple statements.
The demo opens SQLite in mode=ro. The production path is a dedicated read-only Postgres role with SELECT grants only.
Every query is printed before execution so the system leaves a clear record of what the AI asked from the warehouse.
The allowlist accepts false positives, such as rejecting a literal string that contains DROP, because finance workflows should favor safety.
Source notes
This page keeps the same source-note pattern as the rest of the portfolio: anonymized data, real project files, and no softened claims.
Safety allowlist, read-only database execution, seeded demo warehouse, and tests against the real seeded database.
The Claude API tool-calling loop follows the Anthropic SDK pattern, but the live API round trip was not tested in the build environment because no API key was available.
Swap SQLite for Postgres through a dedicated read-only role, add a lightweight web UI, and log question, generated SQL, and answer for auditability.