Datasette adds approval steps for agent-built web apps

The datasette-apps plugin released version 0.3a0 on 4 November 2026, adding user approval requirements and permission checks to the way an AI agent creates and edits custom web applications inside Datasette, according to release notes published on the project author's blog.

Datasette is an open-source tool for publishing and exploring data. The datasette-apps plugin lets users host and edit custom HTML applications inside it. The notes say these apps can be written by hand, but that it is easier to create them using large language models through Datasette Agent, a companion chat interface. The 0.3a0 release is described as an improvement to that integration.

The most security-relevant changes concern stored queries, which are saved SQL statements that an app is allowed to call. The release adds two new tools, app_add_stored_queries() and app_remove_stored_queries(), which let the agent manage which stored queries a given app can use. According to the release notes, granting a write query through these tools requires approval from the user first.

The app creation path has been tightened in the same way. The notes say app_create() now checks that each requested stored query actually exists, and that the user has permission to view it, before an app is built. If any of the requested queries write to the database, the agent asks the user to approve them before the app is created.

That pattern matters because an agent assembling an application decides, on its own, which saved queries that application should be wired up to. Without a check, a query that modifies data could be attached without the person in the chat window noticing. The release notes place a human confirmation step in front of exactly those write operations, while leaving read-only queries to proceed once the existence and visibility checks pass.

The release also changes how apps are referenced and viewed. Users can now tag an app in a Datasette Agent chat message by typing a hash character, which autocompletes from the apps that user has permission to view. The autocomplete list is therefore scoped to the user's own permissions rather than to every app on the instance.

The "View app" buttons shown by the agent tools, and the links generated by hash references, now open the app full screen inside the Datasette Agent panel, the notes say.

The version number indicates an alpha release. The notes do not describe any reported incident or vulnerability prompting the changes, and do not list further planned work on the permission model.