PostgreSQL
psqlAn agent with psql on its PATH can reach a database. Memnox wraps the binary, reads the command before it runs, and matches it against the table below. Nothing here is a list of what we support: it is what the runtime already classifies, and the strings are the ones a rule matches on.
What it reads to authenticate
Discovery records that these exist and hashes them. It never reads a value, so a scan can say three agents reach this file and never what is inside it.
What it changes
Allowed by default, and the obvious first thing to put behind ask.
psql -c **psql.c- statement is read from the argument
psql **psql.run- an interactive session can do anything
The rule this writes
[[rules]] name = "psql-destructive-asks-first" match.actions = ["psql.**"] decision.effect = "ask" decision.reason = "This cannot be undone."
memnox protect --for psql writes this into memnox.policies.toml from the table above. You can edit it, and the file is yours.
Run npx memnox to find out whether PostgreSQL is actually reachable from your machine. It reads your own disk and needs no account.