Access-Controlled Text-to-SQL Without Showing the Model the Restricted Schema: Results on Two Public Benchmarks, and a Fail-Closed Bug They Exposed

Text-to-SQL systems deployed inside organisations must answer the questions a user may ask and refuse the ones they may not. We evaluate schemagate, an open-source library combining identity-scoped schema selection (restricted tables and columns never reach the prompt), a one-line notice that the caller's view is partial, and a scope check that refuses any generated query touching data outside the caller's grants. Scored by each benchmark's own protocol, it reaches AC-F1 90.1 on BIRD in the RBAC Text-to-SQL benchmark (best reported: 88.1, same model) and refusal F1 0.984 on all 19,624 Spider-ACL records (best reported: 0.933). No answered query read a table or column outside the caller's grants, verified independently. We also report negative results, including a fail-closed bug in the query check that silently refused valid SQL.