Least Privilege and Built-in Roles

A database account should be able to do what its job needs and nothing more. This is the principle of least privilege, and it matters most for systems you cannot fully predict. An AI agent that writes its own queries, or a dashboard that gets a new feature next month, will use whatever access you leave lying around.

A rule in a prompt is not a boundary. A permission in the database is. If an agent should never see a customer's email address, the safest design is a database account that cannot read it.