Planetscale Change Gates And Approval Contract Agent Skill

Change gates and approval contract

Purpose

Prevent accidental or autonomous changes that can affect availability, safety, security, data, or developer workflows.

Operation classes

Class A: read-only by default

Allowed without approval:

• List databases, branches, keyspaces, webhooks, backups, roles, traffic budgets, schema recommendations, deploy requests, and Insights data.
• Inspect repository code.
• Read schema metadata.
• Read non-sensitive database metadata.
• Produce reports and proposed change sets.

Class B: state-creating proposals

Allowed by default; requires approval only when the operator has demanded strict no-mutation mode:

• Creating a query-pattern report through an API POST, even if the result is read-only telemetry.
• Triggering a webhook test event.
• Creating temporary local branches or files.
• Opening PRs or issues in external tools.
• Creating database development branches.
• Applying DDL or migrations to non-production development branches.
• Opening deploy requests targeting a branch protected by a review workflow.

The last three are proposals inside an existing review system: nothing

reaches production until a human merges or deploys. The gate belongs on

the merge/deploy action (Class C/D), not on proposal creation. An agent

that stops to ask permission to open a PR is misclassifying.

Class C: behavior-changing

Always requires explicit approval:

• Enable safe migrations.
• Disable safe migrations.
• Change deploy request approval settings.
• Create/update/delete Traffic Control budget or rule.
• Move Traffic Control budget to enforce mode.
• Create/update/delete webhook.
• Enable raw query collection.
• Enable/disable extensions or settings that require restart.
• Create/update/delete role.
• Reset passwords.
• Change pg_strict settings.
• Change connection pooling behavior.
• Change IP restrictions, PrivateLink, PSC, or public access.
• Change backup schedule or retention.
• Create restore branch.
• Create backup beyond automatic backups.
• Change branch size or replica topology.
• Edit repository files or dependencies.

Class D: production data/availability impacting

Requires explicit approval, named target confirmation, rollback plan, and ideally a second human review:

• Production DDL.
• Production DML.
• Applying schema recommendation to production.
• Queueing or applying Vitess deploy request to production.
• Promoting or restoring branches.
• Deleting branches, databases, roles, webhooks, backups, or traffic rules.
• Enforcing Traffic Control on production.
• Changing production network access.
• Rotating production credentials.
• Emergency backup during high load.

Class E: never autonomous

Never do without direct human operation or separately approved incident procedure:

• Delete a production database.
• Disable all production safety mechanisms.
• Drop production tables or columns.
• Remove IP restrictions or private-only posture.
• Store or expose secrets in logs, issues, PRs, Slack, or reports.
• Auto-merge code generated from database telemetry.
• Auto-apply DDL generated by an LLM.

Approval requirements

A valid approval must include:

• Change ID.
• Target organization/database/branch.
• Whether production is affected.
• Permission to execute the exact action.

Invalid approvals:

• “Do the best practices.”
• “Fix everything.”
• “Apply recommendations.”
• “Go ahead” without named change IDs.

Autonomous execution exception

There is exactly one alternative to per-change approval: the risk-acknowledged

autonomous mode defined in ../13-autonomous-execution-mode/SKILL.md. When the

operator explicitly acknowledges the risk, names a scope, and states whether

production is included, that acknowledgment substitutes for per-change approval

of Class B/C (and Class D when production is included) actions **within the

named scope only**.

Everything else in this skill still applies in autonomous mode:

• Class E is never unlocked by any phrasing.
• The pre-execution checklist must still be produced for every Class C/D step

(shown as the execution plan, not as a stop-and-wait).

• The post-execution report is still required.
• Out-of-scope work still requires new approval or new acknowledgment.

Required pre-execution checklist

Before any Class C or D action, produce:

• Exact command, API endpoint, dashboard action, SQL, or repository diff.
• Target confirmation.
• Expected effect.
• Availability impact.
• Data risk.
• Security risk.
• Rollback plan.
• Validation plan.
• Monitoring plan.

Then stop for approval.

Required post-execution report

If an approved change is later executed, report:

• What changed.
• When it changed.
• Who approved.
• Interface used.
• Evidence of success.
• Any warnings.
• Rollback state.
• Follow-up monitoring.

Required refusal behavior

If asked to apply broad or ambiguous production changes, refuse the broad action and produce a safer named change plan.

Use this sentence:

“I will not apply broad production changes from an ambiguous instruction. I can produce a named change set with risk and rollback details.”