Essay · August 8, 2026
Why our language models don't get to write SQL
There's a line we won't cross, and it's the same line that makes our systems boring to demo and safe to deploy. The language model in our spatial systems does not write SQL. It doesn't get a database connection. It plans, it explains, it chooses from a menu, and then it hands off to code that a person wrote and tested. Everyone who's watched the flashier version wants to know why we'd give up the magic. This is why.
What "let the model write SQL" actually costs
When you let a model author raw queries against live data, you've accepted that on some percentage of prompts it will do something you didn't sanction. Scan a column it shouldn't. Join two tables whose relationship it guessed. Write something eloquent about the wrong neighborhood because it weighted a similarity score over a distance. Most of the time it's fine, and "most of the time" is precisely the standard that fails an audit. A system that's usually right about zoning is a system nobody in a regulated organization can stand behind.
The division of labor that works
So we split the job. The model coordinates and explains, because that's what it's genuinely good at. Deterministic code performs the spatial operations, because that's what has to be reproducible. Every operation is typed and audited: a function with a known signature, a known cost, and a test. The model can ask for a distance calculation; it cannot invent one. It can request a hotspot analysis; it cannot improvise the statistics inside it.
The effect is that the surface where things can go wrong shrinks to almost nothing. The model isn't being trusted to know facts about your data. It's being trusted to route a question to an operation that does, and to say so with citations.
Approval is part of the design, not a bolt-on
The same principle governs writes. Anything that changes state, sends a memo, updates a record, waits for a person. The system drafts; a human decides. We learned to build it that way from the start, because retrofitting an approval gate after the fact is how you end up with a system that already did the thing before anyone could stop it.
The honest limit
This design has a cost and it's real: it's more work, and it's less impressive in a fifteen-minute demo. A competitor who lets the model write SQL will show you something that looks more capable in the room. Our answer is that we're optimizing for the twelfth month, not the first meeting, and for the auditor, not the applause. If what you need is a dazzling demo, we're the wrong firm, and we'll tell you so early.