AgentsAutonomy & tool use
datasette-apps 0.3a0 makes users approve write access before Datasette Agent's apps can modify data
The latest alpha of datasette-apps, a plugin for LLM-generated HTML tools that run sandboxed inside Datasette, now makes users approve write access when Datasette Agent creates an app or attaches a stored query that modifies data.
From the Simon Willison article of November 4, 2026 and cited sources: Datasette Agent can now add or remove the stored queries an app may call. [1] [2]
SOURCES[1] datasette-apps 0.3a0 simonwillison.net[2] GitHub: datasette-apps release 0.3a0 github.com
AT Pulse research deskPublished · Updated · 5 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- Original source
- Simon Willison article, independent perspective
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- When
- November 4, 2026 article published
- Covered
- Nov 6 edition
- Evidence
- 11 sources across 6 sites
Reach: not measured yet
Datasette Agent can now add or remove the stored queries an app may call. Any write query added this way needs the user's approval first. App creation also checks that each requested query exists and that the user is allowed to view it. [1] [2]
Apps run in sandboxed iframes with a Content Security Policy. Network access is blocked unless specific HTTPS origins are configured. Apps reach data either through direct SQL or through an allow-list of stored queries, and both paths go through Datasette's existing permission checks. Users who hold the CSP-setting permission can allow any HTTPS origin, which weakens the sandbox. [6]
The new gate matches how Datasette Agent already works: it asks a human to approve every write and shows the full SQL and parameters. Treating an app's capabilities as an editable allow-list, with explicit sign-off for writes, is a governance pattern other in-house agent platforms could reuse. [7]
Documented behavior: the agent can now edit an app's stored-query allow-list, and writes at that boundary need human sign-off.
Read the full assessment
Implication: teams building internal agent platforms get a reusable governance pattern, though protection depends on how carefully users review approvals.
Executive brief
The datasette-apps 0.3a0 release adds a permission gate between an AI agent and the database it is building apps against. When Datasette Agent creates an app, or later lets that app call a stored query that writes data, the user now has to approve that write access first (GitHub release 0.3a0). Datasette Apps are small HTML/JavaScript tools that run sandboxed inside Datasette, the open-source SQLite publishing tool, and are usually generated by an LLM (Simon Willison's release note). This is an alpha release. There is no independent reporting or evaluation of it, only the developer's own materials and aggregator rewrites.
What changed and event timeline
Datasette Agent alpha appears
Version 0.1a0 of Datasette Agent shipped as a "silent" alpha. It is an LLM-powered chat assistant for querying Datasette instances ().
Datasette-apps first alpha
Version 0.1a0 was the first public release of a plugin for hosting custom HTML apps inside Datasette ().
Agent integration lands
In 0.1a1, frames talk to each other through
MessageChannel(). The release also registered tools so Datasette Agent can create and modify apps, and added a panel that logs SQL and console output ().CSP controls and permission fixes
Releases 0.1a2 and 0.1a3 added Content Security Policy (CSP) controls and fixed permission bugs in app creation and editing ().
Agent debugging tools
Version 0.2a0 added
app_debug()andapp_list(), so the agent can test and find apps ().0.3a0 adds approval gates
This release added
#tagging of apps in chat, tools for managing stored queries, and user approval for write queries. It requires Datasette 1.0a41 or later ().
Capabilities and access
Read the full section
- Version: datasette-apps 0.3a0. Requires Datasette 1.0a41+ and Python 3.11+. Adds Python 3.15 support and drops 3.10 (release).
- Install:
datasette install datasette-apps. Apps are managed at/-/apps(README). - New agent tools:
app_add_stored_queries()andapp_remove_stored_queries().app_create()now checks that each requested query exists and that the user can view it (release note). - Usability: typing
#autocompletes from apps the user has permission to view. "View app" links open full screen in the Agent panel.
Technical analysis for researchers and developers
- Sandbox: apps run in sandboxed iframes with CSP enforced.
- Data bridge: apps reach data in two ways.
datasette.query()runs SQL directly.datasette.storedQuery()runs only queries on the app's allow-list. - What 0.3a0 changes: the agent can now edit an app's stored-query allow-list.
Read the full section
- Sandbox: apps run in sandboxed iframes with CSP enforced. Direct network access is blocked unless exact
https://origins are configured, and localhost is never allowed (README). - Data bridge: apps reach data in two ways.
datasette.query()runs SQL directly.datasette.storedQuery()runs only queries on the app's allow-list. Both go through Datasette's existing permission checks (README). - What 0.3a0 changes: the agent can now edit an app's stored-query allow-list. That makes the allow-list a capability boundary the agent can modify, so approving writes at that point is the relevant safeguard.
- Consistent approval model: Datasette Agent already asks for human approval before every write and shows the full SQL and parameters (datasette-agent repo).
- Extension point:
#tagging builds on the agent'sregister_agent_reference_typeshook (datasette-agent repo).
Claims and evidence
- Agent creates apps more easily than writing them by hand: this is the developer's own framing (release note). No benchmark or user study supports it.
- Write queries need user approval: stated in the release notes (GitHub release). This is documented behavior. No third-party security review exists.
- Sandbox blocks unlisted network access: stated in the README. The code is open source, so it can be checked, but no independent audit exists.
Read the full section
- Agent creates apps more easily than writing them by hand: this is the developer's own framing (release note). No benchmark or user study supports it.
- Write queries need user approval: stated in the release notes (GitHub release). This is documented behavior. No third-party security review exists.
- Sandbox blocks unlisted network access: stated in the README. The code is open source, so it can be checked, but no independent audit exists.
- Independent corroboration: none available. Pages such as fooqux and ecosistemastartup appear to restate the developer's posts rather than report independently.
Context and prior work
- Datasette Agent builds on Willison's LLM Python library, which supports several model vendors through plugins (devaitools analysis). That piece is secondary commentary.
- Existing agent plugins include datasette-agent-charts, which uses Observable Plot (aiflow summary).
- Datasette Apps follow a familiar pattern: the LLM generates a self-contained artifact that runs in a sandbox.
Read the full section
- Datasette Agent builds on Willison's LLM Python library, which supports several model vendors through plugins (devaitools analysis). That piece is secondary commentary.
- Existing agent plugins include datasette-agent-charts, which uses Observable Plot (aiflow summary).
- Datasette Apps follow a familiar pattern: the LLM generates a self-contained artifact that runs in a sandbox. The plugin writes a prompt in the browser that includes the database schema and the sandbox rules (README).
Limitations, safety and contested findings
- Every release so far is an alpha, and this one requires an alpha version of Datasette 1.0 (release).
- 0.1a3 fixed permission bugs in creating and editing apps, so the permission layer has already needed corrections (releases).
- Users with the
apps-set-csppermission can allow any HTTPS origin, which weakens the network sandbox (README).
Read the full section
- Every release so far is an alpha, and this one requires an alpha version of Datasette 1.0 (release).
- 0.1a3 fixed permission bugs in creating and editing apps, so the permission layer has already needed corrections (releases).
- Users with the
apps-set-csppermission can allow any HTTPS origin, which weakens the network sandbox (README). - Human approval only protects data as well as users review what they approve. The reviewed sources contain no security evaluation.
Business and practitioner implications
- Internal tools: teams can have an LLM generate small CRUD dashboards on top of SQLite.
- Agent governance pattern: two ideas here carry over to other in-house agent platforms.
- Adoption risk: the APIs are alpha and require specific Datasette 1.0 alpha versions. Pin versions and test before upgrading anything that matters.
Read the full section
- Internal tools: teams can have an LLM generate small CRUD dashboards on top of SQLite. The permissions that already exist in Datasette control who can see and use each app.
- Agent governance pattern: two ideas here carry over to other in-house agent platforms. Every write needs explicit approval, and an app's capabilities are an editable allow-list.
- Adoption risk: the APIs are alpha and require specific Datasette 1.0 alpha versions. Pin versions and test before upgrading anything that matters.
- Due diligence: there is no independent evaluation, so security teams should review the iframe bridge and CSP code themselves.
The source trail.
Sources (11)
datasette-apps 0.3a0
Article text retrieved; extracted text may omit tables or interactive elements.
simonwillison.net