> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/database-devops/use-db-devops/governance-and-compliance/ai-impact-analysis-pipeline.md).

# AI-Powered SQL Impact Analysis with Conditional Approval

The **Database Impact Analysis** agent reviews SQL changes against zero-downtime safety criteria and emits a `VALIDATION_STATUS` of `PASS` or `FAIL`. When you wire this agent between a Preview SQL step and a conditional Harness Approval step, your pipeline applies safe changes automatically and escalates risky changes to a DBA for review.

![Database Impact Analysis](/files/CeQ1mSIQk8DYKuaH3MzM)

### Before you begin <a href="#before-you-begin" id="before-you-begin"></a>

Before you begin, ensure you have:

* **Database DevOps pipeline:** You need an existing or new pipeline with a Custom stage. Go to [Create a pipeline in Database DevOps](/database-devops/use-db-devops/deployment-pipeline-configuration/create-a-pipeline.md) to set one up.
* **Kubernetes infrastructure:** The Preview SQL and Agent steps run in a step group with Kubernetes infrastructure. Go to [Set up connectors](/database-devops/setup-db-devops/jdbc-connection-string/set-up-connectors.md) to configure the required connectors.
* **LLM connector:** The agent requires an Anthropic or Bedrock LLM connector. Go to [Configure LLM for Database DevOps](/database-devops/use-db-devops/create-database-updates/configure-llm-for-database-devops.md) to create one.
* **Approver user group:** The conditional approval step routes to a user group. Create or confirm your DBA user group exists in Harness before adding the step.

### How the pipeline works <a href="#how-the-pipeline-works" id="how-the-pipeline-works"></a>

The pattern uses three sequential steps:

1. **Preview SQL** - generates the SQL Harness will apply, without touching the database.
2. **Database Impact Analysis agent** - receives the generated SQL and evaluates it against zero-downtime safety criteria. It writes `VALIDATION_STATUS=PASS` or `VALIDATION_STATUS=FAIL` and a `SUMMARY` to its output variables.
3. **Conditional approval** - runs only when `VALIDATION_STATUS` is not `PASS`. The approval message includes both the agent's summary and the raw SQL so the approver has full context.

If the agent returns `PASS`, the pipeline skips the approval step and proceeds directly to apply the schema change.

### Add the preview SQL step <a href="#add-the-preview-sql-step" id="add-the-preview-sql-step"></a>

Place the Preview SQL step in a step group with Kubernetes infrastructure. This step group also holds the agent step.

1. In your pipeline, select the Custom stage, then select the **Execution** tab.
2. Select **Add Step Group**, enter a name such as `Preview SQL`, and select **Kubernetes** as the infrastructure type.
3. Configure the Kubernetes connector and namespace for the step group.
4. Inside the step group, select **Add Step** and select **DB Schema Update SQL** (Preview SQL).
5. Configure the step:
   * **Connector:** select your container image connector (for example, `account.harnessImage`).
   * **DB Schema:** enter or reference your schema identifier.
   * **DB Instance:** enter the target instance, or use an expression such as `<+pipeline.variables.dbInstance>`.
6. Note the step's identifier - you need it to reference the SQL output in the next step. For example, `Test_Policies`.

### Add the Database Impact Analysis agent step <a href="#add-the-database-impact-analysis-agent-step" id="add-the-database-impact-analysis-agent-step"></a>

Add the agent step inside the same step group, after the Preview SQL step.

1. Inside the `Preview SQL` step group, select **Add Step** and select **Agent**.
2. In the **Agent Name** field, enter `databaseImpactAnalysis`.
3. Configure the agent settings:
   * **LLM Connector:** select your Anthropic or Bedrock connector (for example, `account.harnessAnthropic`).
   * **Model Name:** enter the model identifier (for example, `global.anthropic.claude-haiku-4-5-20251001-v1:0`).
   * **SQL:** pass the output from the Preview SQL step using the expression:

     ```
     <+execution.steps.Preview_SQL.steps.Test_Policies.output.sqlCommands>
     ```

     Replace `Preview_SQL` with your step group identifier and `Test_Policies` with your Preview SQL step identifier.
   * **MCP Connectors:** optional. Add MCP connectors if you need additional schema or database context.

The agent step writes two output variables when it completes:

| Variable            | Values           | Description                                                                 |
| ------------------- | ---------------- | --------------------------------------------------------------------------- |
| `VALIDATION_STATUS` | `PASS` or `FAIL` | Whether the SQL meets zero-downtime safety criteria.                        |
| `SUMMARY`           | Text             | A concise explanation of what the change does and why it is or is not safe. |

### Add the conditional approval step <a href="#add-the-conditional-approval-step" id="add-the-conditional-approval-step"></a>

Add a Harness Approval step after the step group. Configure it to run only when the agent fails validation.

1. Outside the step group, select **Add Step** and select **Harness Approval**.
2. Set the **Timeout** to your required review window (for example, `1d`).
3. In the **Approval Message** field, include both the agent summary and the raw SQL:

   ```
   Please review the SQL that will be applied and approve or reject the change.

   AI Analysis: <+pipeline.stages.DB_Migrate.spec.execution.steps.Preview_SQL.steps.SQL_Impact_Analysis.steps.agent.output.outputVariables.SUMMARY>

   Raw SQL: <+execution.steps.Preview_SQL.steps.Test_Policies.output.sqlCommands>
   ```
4. Under **Approvers**, select the user group responsible for database changes (for example, `account.DBAs`).
5. Select the **Conditional execution** toggle and enter this condition:

   ```bash
   <+execution.steps.Preview_SQL.steps.SQL_Impact_Analysis.steps.agent.output.outputVariables.VALIDATION_STATUS>!="PASS"
   ```

   Replace `Preview_SQL` and `SQL_Impact_Analysis` with your actual step group and agent step identifiers.
6. Set **Stage Status** to `Success`.

When the pipeline runs, this step only appears when the agent emits `FAIL`. Approved runs proceed to the apply step; rejected runs abort.

### Apply the schema change <a href="#apply-the-schema-change" id="apply-the-schema-change"></a>

Add a DB Schema Apply step after the approval step to deploy the reviewed changes.

Go to [Apply a DB schema step](/database-devops/use-db-devops/deployment-pipeline-configuration/step-types/apply-dbschema-step.md) to configure the apply step, rollback behavior, and matrix strategy for multiple instances. ![Step Result of Agent Review](/files/VqSUyXJyXkRxcJfg2Xrv)

### Complete pipeline YAML <a href="#complete-pipeline-yaml" id="complete-pipeline-yaml"></a>

The following YAML shows the full pipeline configuration for a single-branch scenario. Adapt the step group names, connectors, and variable references to match your environment.

{% tabs %}
{% tab title="visual structure" %}
![Visual Overview of pipeline](/files/eH5l4JLqWXqBP7BBW6vg)
{% endtab %}

{% tab title="YAML" %}

```yaml
stages:
  - stage:
      name: DB Migrate
      identifier: DB_Migrate
      type: Custom
      spec:
        execution:
          steps:
            - stepGroup:
                name: Preview SQL
                identifier: Preview_SQL
                steps:
                  - step:
                      type: DBSchemaUpdateSQL
                      name: Test Policies
                      identifier: Test_Policies
                      spec:
                        connectorRef: account.harnessImage
                        dbSchema: <+pipeline.variables.dbSchema>
                        dbInstance: <+pipeline.variables.dbInstance>
                      timeout: 10m
                  - step:
                      type: Agent
                      name: SQL Impact Analysis
                      identifier: SQL_Impact_Analysis
                      spec:
                        agentName: databaseImpactAnalysis
                        agentSettings:
                          llmConnector: account.harnessAnthropic
                          modelName: global.anthropic.claude-haiku-4-5-20251001-v1:0
                          SQL: <+execution.steps.Preview_SQL.steps.Test_Policies.output.sqlCommands>
                stepGroupInfra:
                  type: KubernetesDirect
                  spec:
                    connectorRef: <your_k8s_connector>
                when:
                  stageStatus: Success
                  condition: <+pipeline.variables.branch>=="main"
            - step:
                type: HarnessApproval
                name: DBA Approval if Validation Fails
                identifier: DBA_Approval
                spec:
                  approvalMessage: "Please review the SQL that will be applied and approve or reject the change.\n\nAI Analysis: <+pipeline.stages.DB_Migrate.spec.execution.steps.Preview_SQL.steps.SQL_Impact_Analysis.steps.agent.output.outputVariables.SUMMARY>\n\nRaw SQL: <+execution.steps.Preview_SQL.steps.Test_Policies.output.sqlCommands>"
                  includePipelineExecutionHistory: true
                  isAutoRejectEnabled: false
                  approvers:
                    userGroups:
                      - account.DBAs
                    minimumCount: 1
                    disallowPipelineExecutor: false
                  approverInputs: []
                timeout: 1d
                when:
                  stageStatus: Success
                  condition: <+execution.steps.Preview_SQL.steps.SQL_Impact_Analysis.steps.agent.output.outputVariables.VALIDATION_STATUS>!="PASS"
```

{% endtab %}
{% endtabs %}

### Agent template reference <a href="#agent-template-reference" id="agent-template-reference"></a>

The Database Impact Analysis agent is a Harness-provided template. You can also install it directly from the Harness AI Agents catalog. The template inputs are:

| Input            | Type      | Required | Default                                           | Description                                    |
| ---------------- | --------- | -------- | ------------------------------------------------- | ---------------------------------------------- |
| `sql`            | string    | Yes      | -                                                 | The SQL migration or change script to analyze. |
| `llm_connector`  | connector | Yes      | `account.harnessAnthropic`                        | The Anthropic or Bedrock LLM connector.        |
| `model_name`     | string    | Yes      | `global.anthropic.claude-haiku-4-5-20251001-v1:0` | The model identifier or inference-profile ARN. |
| `mcp_connectors` | array     | No       | -                                                 | MCP connectors for additional schema context.  |

The agent evaluates the SQL against these safety criteria:

* Backward compatible with old and new application versions running simultaneously.
* Does not create locks lasting more than 500ms.
* Does not cause data loss or an outage.
* Can be undone.

### Next steps <a href="#next-steps" id="next-steps"></a>

* Go to [Preview SQL with manual approval](/database-devops/use-db-devops/governance-and-compliance/using-approval-gates-with-harness-ui.md) to set up approval gates without AI analysis.
* Go to [Apply a DB schema step](/database-devops/use-db-devops/deployment-pipeline-configuration/step-types/apply-dbschema-step.md) to configure the apply step after approval.
* Go to [Using OPA with Database DevOps](/database-devops/use-db-devops/governance-and-compliance/using-opa-with-database-devops.md) to add policy enforcement alongside AI analysis.