Policy-Conditioned Constrained Decoding for Column-Level Access Control in Text-to-SQL

PCC-SQL: Deterministic Column-Use Policy Enforcement via Grammar-Aligned Logits Masking

Ryoto Miyamoto; Xin Fan; Hayato Yamana· 2026· DOI 10.48550/arXiv.2607.12341

The core problem

Text-to-SQL systems are increasingly deployed across trust boundaries between data providers and users, necessitating a balance among three competing requirements: policy compliance, answer coverage, and bounded cost. Existing approaches typically decide refusal based on which columns a query mentions and enforce it stochastically. However, whether a query is compliant depends not only on which columns appear but on how they are used. Stochastic enforcement cannot deterministically rule out violations. This work formalizes the requirement as a column-use policy over semantic use: output, filter condition, and aggregation argument. The proposed system, PCC-SQL, integrates the policy by aligning each role with grammar productions tracked by the decoder, applying a per-token logits mask that deterministically eliminates single-query column-use violations on the supported SQL fragment in a single decoding pass.

PCC-SQL was evaluated across three benchmarks and three open-source models. On Spider-CU, it achieved 0% Leakage Rate and Coverage up to 88.7%, while staying within +10% tokens of direct prompting. The system also assessed semantic alignment with execution accuracy. These results demonstrate that deterministic policy enforcement can be achieved without significant cost overhead. The 0% leakage rate indicates that no policy violations occurred in the generated queries, and the high coverage shows that the system can still answer a large proportion of queries. The token efficiency is crucial for practical deployment, as it ensures that the system remains cost-effective.

Text-to-SQL systems are increasingly deployed across trust boundaries between data providers and users, necessitating a balance among three competing requirements: policy compliance, answer coverage, and bounded cost. Existing approaches typically decide refusal based on which columns a query mentions and enforce it stochastically. However, whether a query is compliant depends not only on which columns appear but on how they are used. Stochastic enforcement cannot deterministically rule out violations. This work formalizes the requirement as a column-use policy over semantic use: output, filter condition, and aggregation argument. The proposed system, PCC-SQL, integrates the policy by aligning each role with grammar productions tracked by the decoder, applying a per-token logits mask that deterministically eliminates single-query column-use violations on the supported SQL fragment in a single decoding pass.

PCC-SQL formalizes column-use policies over three semantic roles: output, filter condition, and aggregation argument. These roles are aligned with grammar productions tracked by the decoder. During decoding, a per-token logits mask is applied to eliminate any token that would lead to a violation of the policy for the current query. This mask is computed based on the current state of the grammar and the policy, ensuring that only compliant SQL queries are generated. The approach is deterministic, meaning that no stochastic sampling is involved in enforcement. The system operates on a supported SQL fragment, which includes SELECT, FROM, WHERE, GROUP BY, and HAVING clauses, as well as aggregation functions. The decoding process is a single pass, integrating policy enforcement seamlessly with generation.

The key innovation of PCC-SQL is the integration of policy enforcement into the decoding process via grammar-aligned logits masking. This approach ensures deterministic compliance, unlike stochastic methods that cannot guarantee zero violations. The formalization of column-use policies over semantic roles allows for precise control over how columns are used, addressing the limitation of approaches that only consider column mentions. The results show that PCC-SQL achieves a strong balance between compliance and coverage. However, the approach is limited to a supported SQL fragment; extending it to full SQL would require handling more complex constructs. Future work could explore adaptive masking strategies to further reduce token overhead and integrate more expressive policies. The semantic alignment with execution accuracy suggests that the generated queries are not only compliant but also correct, which is essential for user trust.

CS practitioners and researchers

Opening member content…