pg_command_fw

A PostgreSQL extension (built with pgrx) that acts as a command firewall — it intercepts DDL and utility statements via the ProcessUtility hook, and dangerous built-in function calls via the post-parse analyze hook, then either allows or blocks them based on per-category GUC flags.