How to pass user data in the user question?

[swati-ncash]

If a user asks a question like "what is my address?" then I should be able to send user id in the question so that only my data is fetched. this can be done by replacing 'my' with user id and send it to generate_sql. This works. But what if the question doesnt have any such prononon that can replaced then how to send user identifier in the question to LLM.
Also, def generate_sql(self, question: str, **kwargs) -> str: has **kwargs. How to use these?

[zainhoda]

Vanna is designed to be an AI Data Analyst as laid out here: https://vanna.ai/docs/vision/

My sense is that the specific thing you're trying to do is to build a chatbot that happens to be able to look up ancillary information in a SQL database. That's somewhat outside of the scope of what we're trying to accomplish because the data analysis use case has different requirements than a generic chatbot.

That being said, what I've seen others do in your situation is silently add information about the user to the question to the question.

kwargs doesn't do anything right now. That's purely there if you are going to override certain Vanna functionality and need the ability to pass additional arguments to certain functions without breaking the inheritance from the abstract base class.

[sqlldev]

@zainhoda Is it safe to add silently information about the user to the question? If user will ask "show me the addresses of all users" and I will silently add " show results only for user with id {id}"?

Is there a safer way to achieve this?

[zainhoda]

@zainhoda Is it safe to add silently information about the user to the question? If user will ask "show me the addresses of all users" and I will silently add " show results only for user with id {id}"?

Is there a safer way to achieve this?

That is what people do if you already have row level security in place and the database user that you're using to query is tied to the user who's asking the question.

If you're not using row-level security on the database, then what others have done in your position is to put a step between sql generation and execution where you inject a where clause that restricts the data retrieved. This only works if you are doing simple select statements. If your generating very complex SQL with CTEs, etc then it'll be much harder to add the where clause in the appropriate place.

Ultimately it depends on your specific case.

[sqlldev]

Thanks for quick answer.
My use case:
I'm building a chatbot for my customers, to let them ask about their sales data. For example: "What are the top two moving products in my shop?" or "What is the average transaction value for this month?"
As I know users, they will for sure come up with more complicated questions, so my queries will be more complex than simple selects.
Looks like I'll need another AI to understand generated by Vanna query to add user context and this sounds like another place where errors can occur :(

[sqlldev]

I'll experiment with these options and share which solution works best for me. Maybe, my experience can be helpful to someone else ;)
Ideas:

• row-level security
• separate SQLite DB for each user
• Views with predefined WHERE user_id

[clluiz]

Hi @sqlldev I'm working on a very similar product here. Did you find a good solution to this problem? Did you find a good alternative to Vanna?