Query Pilot Minion Exec Policy

Minion Exec Policy is a script-level guardrail for Query Pilot. It solves a simple, expensive problem: important SQL scripts often know where and when they are safe to run, but that knowledge usually lives in a file name, a comment, a runbook, or somebody's memory. Query Pilot reads that intent directly from the script and turns it into visible checks before execution.

Use it when a script must:

• Run only against specific servers or databases.
• Automatically move Query Pilot to the correct server and database before Run.
• Block accidental execution in the wrong environment.
• Warn or block outside an approved maintenance window.
• Enforce case-sensitive identifier spelling before a script reaches a case-sensitive SQL Server.

The policy is written as a SQL block comment, so the script remains valid in SSMS, sqlcmd, and other SQL tools. Query Pilot hides the raw comment chrome behind a highlighted MINION EXEC POLICY editor section so the policy reads like part of the editor while the portable SQL text stays in the script.

/* MINION EXEC POLICY
RunMode: Auto
Server: SQL01, SQL02
Database: Minion
BlockIfDifferent: true
EnforceCase: Enforce
AllowedDays: Sat, Sun
AllowedTime: 22:00-05:00
BlockedDays: Mon-Fri
BlockedTime: 12:00-17:00
Timezone: Mountain Standard Time
*/

What Users See

When Query Pilot recognizes a policy, the editor renders the block as a distinct policy region instead of plain green comments. The SQL still contains the normal block comment markers, but the editor makes the policy stand out so operators can see that the script carries execution rules.

The compact shield beside the Check button summarizes the whole policy. These are the same shield shapes used in the toolbar:

The margin marks beside each directive show exactly which rule passed or failed. Hover a mark to see the directive name, expected value, actual value, and the reason for the result.

Policy editor commands are highlighted in yellow while they are waiting to be expanded. The yellow line appears as soon as the user types @ inside the policy region. It is a visual cue that the text is an editor command, not a policy directive and not SQL that will be sent to the server.

Why This Is Big

The policy travels with the script. That means a saved query, a script library item, an emailed .sql file, or a deployment script can carry its own execution rules without depending on a separate checklist. A new DBA can open the script and Query Pilot immediately shows whether the current target, database, time window, and identifier casing are safe.

It also removes a class of quiet mistakes:

• A production-only script opened while Query Pilot is pointed at a dev database.
• A heavy inventory or maintenance query run during business hours.
• A case-sensitive deployment that looked fine on a case-insensitive SQL Server.
• A script intended for SQL01 and SQL02 accidentally run against every checked server.

Directives

• RunMode: Auto applies declared servers and databases only when paired with EnforceCase: Enforce. Auto with EnforceCase: Block validates the current selections and blocks Run on mismatches without changing them. Check validates the current selections without changing them.
• TargetMode: controls how Query Pilot resolves the target list. Selected uses the current tab selection, Explicit requires Server and Database, DatabaseFirst finds repo servers that contain the declared Database, and RepoFilter finds repo servers from metadata filters.
• Server: comma, semicolon, or pipe-delimited server names.
• Database: comma, semicolon, or pipe-delimited database names.
• Environment: repo environment filter, such as Prod, Dev, QA, or Stage.
• SLA: repo service-level filter, such as Gold, Silver, or Bronze.
• Role: repo role filter, such as Reporting, OLTP, AGPrimary, AGSecondary, or Utility.
• Location: repo location filter, such as Denver or Dallas.
• App: repo application filter.
• ExcludeServer, ExcludeEnvironment, ExcludeSLA, ExcludeRole, ExcludeLocation, and ExcludeApp: exclusions used by discovered target modes.
• BlockIfDifferent: true blocks mismatched selected scope in Check mode. false, no, or 0 disables selected-scope mismatch blocking.
• EnforceCase: overrides the Query Pilot option for this script. Warn reports mismatches, Block prevents execution when mismatches exist, and Enforce rewrites identifiers to declaration/catalog case. Legacy true maps to Enforce; false maps to Warn. Block and Enforce require Server and Database directives in the same Minion Exec Policy so catalog-backed validation has one deterministic source.
• AllowedDays: days or day ranges when the script may run, such as Sat, Sun or Mon-Fri.
• AllowedTime: allowed local time windows, such as 22:00-05:00.
• BlockedDays: days or day ranges that are blocked.
• BlockedTime: blocked local time windows.
• Timezone: Windows time zone ID such as Mountain Standard Time, Central Standard Time, UTC, or GMT.

Policy Commands

Policy commands are editor actions. Query Pilot expands them when you click Check; they are not sent to SQL Server and they do not run during Run.

Type @ inside a policy region to open command completion. Command mode shows only policy commands, not the regular directive/value list. Pending commands render yellow inside the policy region. After Check expands the command, the yellow command line is replaced by normal policy directives.

Use blank when you want Query Pilot to scaffold the policy and leave values empty:

@create policy blank
@create policy blank with(all except: time)
@create policy blank with(target, repo, case)

Use from current when you want Query Pilot to fill values from the active tab's selected servers, selected databases, and available repo metadata:

@create policy from current with(all except: time)
@create policy from current with(target, repo)
@refresh policy from current with(repo)

with(...) accepts these groups:

except: is only valid with all.

@create policy blank with(all except: time)

This is invalid and Query Pilot marks it as a policy command error:

@create policy blank with(target except: time)

Compatibility Rules

These combinations matter. Query Pilot marks incompatible directives in the policy margin and disables Run when the combination would make execution ambiguous or unsafe.

Editor Feedback

Query Pilot evaluates Minion Exec Policy when the script opens and as the script changes. Each recognized directive receives a pass, warning, or failure mark in the policy margin beside the editor line. Hover a mark to see the directive name, evaluation message, expected value, and actual value.

The compact shield beside the Check button is green when the policy passes, yellow when execution is allowed with warnings, and red when the policy blocks execution. Hover the shield for the overall result and all directive details. When EnforceCase is missing required catalog scope, the red mark appears on the EnforceCase line and its margin tooltip names the missing directive.

Identifier-case and syntax problems retain their colored squiggles in the SQL text. Hover a squiggle to see its source and exact validation message.

Pickers

The editor offers completion pickers for policy values so users do not have to memorize valid tokens:

• Run mode picker for Auto and Check.
• Multi-select day picker for weekday values.
• Time picker for policy windows.
• Time zone picker with standard Windows time zone IDs, UTC/GMT offset, and common abbreviations.
• Server and database completions from the active Query Pilot target and database lists.

Execution

In RunMode: Auto with EnforceCase: Enforce, Query Pilot applies valid Server and Database directives as soon as they are read. By default it checks the declared servers in the main target picker, enables Show Only Selected, pins those targets to the active query tab, selects the declared databases in the database picker, and changes the Object Browser metadata source when exactly one server is declared. Execution uses those same selections. If the user tries to change the server or database while enforced scope is active, Query Pilot immediately restores the scoped values.

In RunMode: Auto with EnforceCase: Block, Query Pilot keeps the current selections and disables Run when the selected servers or databases do not match the policy. It does not auto-correct the picker. This lets an operator see the mismatch instead of having the UI silently move the connection.

In Check mode, Query Pilot keeps the current selections and blocks when the selected servers or databases do not match the policy and BlockIfDifferent is true.

Time policies apply in both modes. A script outside its allowed time or inside a blocked time is blocked.

Scenarios

Pin a Script to Its Only Safe Server

Problem: a script repairs data in Minion and should never run against an arbitrary checked server.

Policy:

/* MINION EXEC POLICY
RunMode: Auto
Server: CODECON
Database: Minion
EnforceCase: Enforce
*/

Result: Query Pilot immediately selects CODECON, selects Minion, updates the tab target, and prevents the user from drifting to a different server or database while that policy is active.

Validate Without Moving the User

Problem: the operator wants to prove the current tab is pointed at the right place, but does not want the policy to auto-correct anything.

Policy:

/* MINION EXEC POLICY
RunMode: Check
Server: SQL01, SQL02
Database: Minion
BlockIfDifferent: true
EnforceCase: Block
*/

Result: Query Pilot checks the current target and database selections. If the tab is pointed somewhere else, the shield turns red and Run is disabled instead of silently moving the selection.

Protect a Heavy Script With a Maintenance Window

Problem: a wide inventory, cleanup, or maintenance script is safe overnight but disruptive during business hours.

Policy:

/* MINION EXEC POLICY
RunMode: Auto
Server: SQL01, SQL02
Database: Minion
AllowedDays: Sat, Sun
AllowedTime: 22:00-05:00
BlockedTime: 12:00-17:00
Timezone: Mountain Standard Time
*/

Result: Query Pilot evaluates the current time in the policy time zone. Outside the allowed window or inside the blocked window, the margin marks show the failing directive and the shield blocks Run.

Catch Case-Sensitive Breakage Before SQL Server Does

Problem: a script was written on a case-insensitive SQL Server, but it may be deployed to a case-sensitive server.

Policy:

/* MINION EXEC POLICY
RunMode: Auto
Server: CODECON
Database: Minion
EnforceCase: Block
*/

Result: Query Pilot uses the declared server and database as the catalog source. Identifier mismatches are marked in the editor and Run is disabled until the spelling matches the catalog.

Minion Exec Policy Settings

Open Query Pilot settings, then select Exec Policy. These preferences are saved immediately:

• Apply enforced scope as soon as it is read controls immediate application while opening or editing a script. It applies only when a script has RunMode: Auto and EnforceCase: Enforce.
• Select and pin query tab servers controls whether the Server directive changes checked Query Pilot targets and pins them to the active tab.
• Turn on Show only selected controls whether applying scoped servers filters the main target list.
• Select query tab databases controls whether the Database directive changes the active tab's database picker.
• Object browser can change only when one server is declared, use the first declared server, or leave the browser unchanged.

These settings affect enforced Auto mode only. RunMode: Check and RunMode: Auto with EnforceCase: Block always validate the current selections without changing them.

Identifier-Case Exec Policy Requirement

Identifier-case checks have two layers:

• Local declarations, such as variables, aliases, and temp tables, can be checked from the text alone.
• Catalog-backed names, such as tables, schemas, procedures, and columns, require one known server and database.

Because of that, EnforceCase: Block and EnforceCase: Enforce fail the policy until the same Minion Exec Policy declares both Server and Database.

/* MINION EXEC POLICY
EnforceCase: Enforce
Server: CODECON
Database: Minion
*/

EnforceCase: Warn can still run without those directives. It reports local issues and warns when catalog identifiers cannot be fully validated.

Related: Query Pilot, Targets, Database picker.

Documentation revision: BDD53C63A2221D18