[VTimofeenko]

That command will have to take some input from neural network though? And we're back in Bobby Tables scenario

[zahlman]

No, that argument makes no sense. SQL injection doesn't happen because of where the input comes from; it happens because of how the input is handled. We can avoid Bobby Tables scenarios while receiving input that influences SQL queries from humans, never mind neural networks. We do it by controlling the system that transforms the input into a query (e.g. by using properly parameterized queries).

[VTimofeenko]

Right, in DBs it's proper param binding + prepared statements.

I see what you're saying, makes sense.

FWIW there is (in analytics) also RBAC layer, like "BI tool acting on behalf of user X shall never make edits to tables Y and Z"