Policy-Conditioned Constrained Decoding for Column-Level Access Control in Text-to-SQL
For data providers deploying Text-to-SQL across trust boundaries, this work provides a deterministic enforcement mechanism for column-use policies, addressing a practical security and compliance need.
The paper addresses column-level access control in Text-to-SQL, formalizing a policy over semantic column use (output, filter, aggregation). The proposed PCC-SQL system uses per-token logits masking to deterministically prevent violations in a single decoding pass, achieving 0% Leakage Rate and up to 88.7% Coverage on Spider-CU with less than 10% token overhead.
Text-to-SQL is increasingly deployed across trust boundaries between data providers and users. Such deployment must balance three competing requirements: policy compliance, answer coverage, and bounded cost. Existing approaches typically decide refusal based on which columns a query mentions and enforce it stochastically. Whether a query is compliant, however, depends not only on which columns appear but on how they are used, and stochastic enforcement cannot deterministically rule out violations. We formalize this requirement as a column-use policy over semantic use: output, filter condition, and aggregation argument. We integrate the policy by aligning each role with grammar productions tracked by the decoder. The resulting system, PCC-SQL, applies a per-token logits mask that deterministically eliminates single-query column-use violations on the supported SQL fragment in a single decoding pass. Across three benchmarks and three open-source models, PCC-SQL achieves 0% Leakage Rate and Coverage up to 88.7% on Spider-CU, while staying within +10% tokens of direct prompting. We additionally assess semantic alignment with execution accuracy.