GuideIntermediate
Sql For Llms And Agents
Learn the engineering behind having an LLM or agent generate and execute SQL safely and reliably against your database: text-to-SQL. This guide covers how to give the model the schema as context (serializing `CREATE TABLE`, sample rows, relationships, and the token budget), how to prompt for correct SQL (few-shot, fixing the dialect, constraint instructions), how to validate and execute generated SQL before trusting it (is it a `SELECT`? does it reference real tables?), security guardrails (read-only, blocking destructive statements, row limits, anti-injection, least privilege), the SQL agent loop (question → SQL → validate → run → correct → answer, with the `run_sql` tool), and how to evaluate a text-to-SQL assistant with execution accuracy. Everything is built on top of the Reservo database with sqlite3; the LLM call is shown as a realistic example using the Claude API. It closes with a capstone project: a safe, measurable, end-to-end SQL assistant for Reservo.
- 64
- lessons
- 8
- modules
- English · Spanish
- available in
- Yes
- certificate
- Free
- access
Outcomes
What you'll be able to do
- Understand the text-to-SQL problem: the promise of querying a database by talking to it, and the dangers (incorrect SQL, hallucinated columns, destructive queries)
- Give an LLM the schema as context: serialize `CREATE TABLE`, sample rows, and relationships while respecting a token budget
- Prompt for correct SQL: few-shot examples, fixing the SQL dialect, constraint instructions, and handling ambiguity
- Validate generated SQL before running it: does it parse? is it a `SELECT`? does it reference real tables and columns? `EXPLAIN QUERY PLAN`
- Implement security guardrails: enforce read-only access, block destructive statements, row limits and timeouts, and the least-privilege principle
- Build the SQL agent loop: question → generate SQL → validate → run → correct → answer, using the `run_sql` tool
- Evaluate a text-to-SQL assistant with execution accuracy, comparing against a question-to-gold-SQL test set
- Build a safe, measurable, end-to-end SQL assistant for Reservo as a capstone project
Before you start
What you need to bring
It's for you if...
- Devs who want to expose a database to an LLM or agent without risking data deletion or leaks
- Backend devs who already know SQL and want a language model to generate it reliably
- Teams evaluating building a natural-language query assistant over their database
Requirements and materials
- Intermediate/advanced SQL (JOINs, aggregations) — or the Advanced SQL Querying Guide completed
- Python 3.10+ (uses `sqlite3` from the standard library, no additional install needed)
- Basic familiarity with the concept of LLM tool-calling/function-calling (explained in the guide)
Content
The syllabus, module by module
Open any of them to see its lessons.
- Module 2 Introduction: Giving the LLM the Schema
- Why the LLM doesn't know your database
- Serializing the schema: DDL vs. compact form
- Column descriptions: cents and domains
- Sample rows in the context
- Extracting relationships with PRAGMA
- The token budget: what to include and exclude
- Mini-project: build a schema context for Reservo
- Module 3 Introduction: Prompting for Correct SQL
- A SQL assistant's system prompt
- Few-shot: question→SQL examples
- Pinning the SQLite dialect
- Constraint instructions and output format
- Handling ambiguity: asking for clarification or stating the assumption
- Asking for SQL + structured explanation
- Mini-project: a SQL assistant prompt for Reservo
- Module 4 Introduction: Validating and Executing the Generated SQL
- Never trust the generated SQL blindly
- Validating the shape: does it parse? a single statement? is it SELECT?
- Validating against the real schema: catching hallucinated tables and columns
- Executing safely: capturing errors and a sanity LIMIT
- The self-correction loop: feeding the error back to the model and retrying
- Common failure modes in generated SQL
- Mini-project: a validate-then-execute pipeline
- Module 5 Introduction: Guardrails and Safety
- The Prompt Is Not a Security Barrier, and Least Privilege
- Read-Only at the Connection: `PRAGMA query_only` and `mode=ro`
- The Statement Allowlist: Only `SELECT`/`WITH`, a Single One
- Resource Limits: Forced `LIMIT`, Timeout, and Row Cap
- Injection: Why the LLM's SQL Is an Attack Surface, and `?` Parameters
- Defense in Layers: All Together, Covering Each Other
- Mini-Project: A Read-Only, Guarded Executor
- Module 6 Introduction: The SQL Agent Loop
- The Agent Loop: Question → SQL → Validate → Run → Observe → Answer
- Tool-Calling: the `run_sql` Contract and Its JSON Schema
- The `tool_use` → `tool_result` Shape of the Messages API
- Multi-Step: Exploring the Schema with a Tool, Then Querying
- When to Stop and the Iteration Cap
- Error Handling Inside the Loop: the Error as a `tool_result` the Model Corrects
- Mini-Project: a SQL Agent Loop for Reservo
- Module 7 Introduction: Evaluating Text-to-SQL
- Why Measure and Not Trust the Impression
- Execution Accuracy vs. Comparing the SQL's Text
- Building the Test Set: Question → gold_sql
- The Harness That Runs the Set and Reports the %
- The Failure Modes the Evaluation Reveals
- Regression: Re-Evaluating When You Change the Prompt or the Model
- Mini-Project: an Evaluation Set for the Reservo Assistant
- Module 8 Introduction: a Safe SQL Assistant for Reservo
- Layer 1: Assembling the Schema Context
- Layer 2: the System Prompt with Rules and Few-Shot
- Layer 3: the Validation Layer
- Layer 4: Guardrails and the Safe `run_sql`
- Layer 5: the Agent Loop with Self-Correction
- Layer 6: the Evaluation Set and Execution Accuracy
- Project: a Safe SQL Assistant for Reservo
Common questions
What people usually ask
No limit. It's a free guide: come in whenever you like, as often as you like.
No. Modules run from easier to harder, but you can jump to the one you need. Progress is saved per lesson.
Whatever is needed is listed under “What you need to bring”, above. If nothing is listed there, you can start from zero.
In the Club's WhatsApp group, and every two weeks there's a live with an instructor where questions get worked through.
Yes. It's issued automatically once you finish every lesson, with a verifiable code you can share on LinkedIn.
Start whenever you like
What students say
These reviews are from enrolled students who completed at least 50% of the course. We moderate reviews only on content grounds (spam, offensive language, personal data), never for being critical or negative.
No approved reviews yet.
Be the first to share your experience!