Avoiding Hallucinated SQL in Production

𝐌𝐚𝐧𝐲 𝐭𝐢𝐦𝐞𝐬, 𝐭𝐡𝐞 𝐒𝐐𝐋 𝐪𝐮𝐞𝐫𝐲 𝐲𝐨𝐮 𝐰𝐫𝐢𝐭𝐞 𝐢𝐬 𝐭𝐞𝐜𝐡𝐧𝐢𝐜𝐚𝐥𝐥𝐲 𝐜𝐨𝐫𝐫𝐞𝐜𝐭… It runs without errors, gives results instantly, and even passes basic checks. But the business answer coming out of it is completely wrong. And this is where most analysts struggle - not with SQL syntax, but with logic. One of the biggest reasons is 𝐠𝐫𝐚𝐢𝐧 𝐦𝐢𝐬𝐦𝐚𝐭𝐜𝐡. You might be joining order-level data with customer-level data and then aggregating, without realizing you’ve multiplied rows. The query looks fine, but revenue suddenly looks inflated. Another common issue is 𝐣𝐨𝐢𝐧𝐬 𝐮𝐬𝐞𝐝 𝐛𝐥𝐢𝐧𝐝𝐥𝐲. A LEFT JOIN instead of INNER JOIN (or vice versa) can silently change your dataset. Missing rows, duplicate rows, or unexpected nulls creep in — and the final metric shifts without any obvious warning. 𝐅𝐢𝐥𝐭𝐞𝐫𝐬 are another trap. Applying filters in the WHERE clause instead of before aggregation, or filtering after a join instead of before it, can completely change the population you’re analyzing. Same columns, same values - different business meaning. I’ve seen dashboards where: • Conversion rates looked “improved” just because returning users were double-counted • Churn looked lower because inactive users were filtered out too early • Revenue jumped because refunds were joined incorrectly None of these were SQL errors. They were thinking errors. This is why senior interviewers don’t just ask “write the query”. They ask: – What is the grain of this metric? – What happens to row count after this join? – Who is included and who is excluded at each step? If you want to grow as an analyst, start doing this before you run any query: • Say out loud what one row represents • Predict how many rows you should get after each join • Ask yourself: “Does this number make business sense?” Correct SQL is easy. Correct business answers take much more thinking.

Everyone asks: how do you trust AI to write SQL without hallucinating? Short answer: you don't. Not until you teach it your data first. I haven't written a SQL query in over a year because Claude does it for me. But I spent time upfront making sure it actually works. Three strategies that matter: 1. Give it real examples. Not documentation, actual queries. Have your data team pull together recent analyses—the question in plain English and the SQL that answered it. I add these to a Claude Project (or a Claude Code skill if I'm using that). Claude learns by example better than it learns by rules, so it'll replicate the patterns. 2. Teach it your schema's weirdness. Every database has columns that are misnamed, deprecated, or just confusing. Tell Claude about them in the project instructions. Example: our signup_source table has a source column that's full of junk and a canonical_source column that's actually clean. I added one instruction—"use canonical_source, not source"—and it never messed up again. 3. Make the Claude Project shared so your whole team can leverage each other's work. Now the next team member doesn't need to do anything to ensure accurate queries. I audited a few dozen queries at the start to build confidence, and now I never second-guess the results.

Some SQL commands are dangerous. Like, lose your job if you mess it up dangerous. How can you avoid messing these things up? 1. If your database supports it, wrap your DELETE statements in a transaction so you can use ROLLBACK 2. Protect vital data, don’t allow your unrecoverable tables to be dropped or deleted from 3. Limit who can use the DROP or DELETE command. Yourself included if you’re untrustworthy😂 4. Don’t develop in Prod. Have two schemas, one for production data and another for development 5. Practice every DELETE and MERGE on a duplicate of the table you’re about to edit. This can you can make sure you alter what you intend 6. If your company has the ability, keep a rolling seven day backup/snapshot of your key tables. That way if something catastrophic happens, you at least have something to recover from I once deleted an aggregate table too early before I was actually ready to delete it. I ended up needing to recreate it and it was a bit painful. These little things I listed above can make SQL a lot safer. #analyticsengineering

10 Golden Rules for Writing Production-Ready SQL 1. Never use SELECT * in production You’re pulling unnecessary columns, increasing I/O, and risking silent breakage when schemas change. 2. Always qualify columns with table aliases When queries grow, ambiguity becomes bugs. Be explicit. 3. Prefer CTEs over deeply nested subqueries Readable queries are maintainable queries. Future you will thank you. 4. Validate row counts after major transformations If your input has 10M rows and output has 3M, do you know why? 5. Be intentional with JOIN types INNER, LEFT, RIGHT — each one changes business logic. Don’t guess. 6. Avoid unnecessary DISTINCT DISTINCT often hides duplication problems instead of solving them. 7. Think about data skew before joining large tables One hot key can destroy performance. 8. Use EXISTS instead of IN when filtering large datasets Short-circuit evaluation can dramatically improve performance. 9. Comment business logic, not syntax Don’t explain what SUM() does. Explain why revenue excludes refunds. 10. Test with edge cases Nulls. Duplicates. Missing keys. Empty tables. Production data is never “clean.” One more truth: If your SQL cannot be understood in 2–3 minutes by another engineer, it’s not production-ready. Data bugs are business bugs. Treat your queries like code — because they are. What rule would you add to this list? Join the group: https://lnkd.in/giE3e9yH Repost to help others in your network ♻️ Follow for more 👋

Every time someone wires a generic AI into your production database, you move one inch closer to a business-ending data breach You just don't see the inch until it's a headline. That's the quiet gamble behind half the "enterprise AI" being shipped in 2026. A vendor slaps an OpenAI wrapper on their product, points it at your live data, and calls it text-to-SQL. Now an unvetted model is generating queries against systems it doesn't understand, with permissions nobody fully audited, returning numbers nobody verified. That's not innovation. That's an incident report waiting for a date. Because the hard part in a big org was never reading your data. It's touching it. Actually executing against messy, sprawling backend systems without leaking, corrupting, or melting production. I use Cursor every day. I love it. But Cursor and everything like it stop at the same wall. They write the code. They don't run it against your data, and they sure don't govern what happens when it does. InQery does both. It executes SQL and Python live against your real data sources inside a governed environment built for the database layer, not bolted onto a chatbot. Mapped to your actual architecture. Scoped. Auditable. Designed so "talk to the data" doesn't mean "hand the keys to a hallucinating intern." And before you file it under launch-day demo: ACA has been running this on energy commodities client work for over a year. No waitlist. No vaporware. Load-bearing on real engagements. The next leap in enterprise AI isn't another model guessing its way through your schema and praying it doesn't trip a permission it was never meant to have. It's execution you can actually trust near production. #EnterpriseAI #DataSecurity #DataEngineering #SQL #AI