Originally published on Medium .

Most AI agent demos put the model on top of the database. The agent gets a "query" tool, the user asks a question, the model writes the query. It works great in a demo. In production, it means the model's judgment is the only thing standing between a user and someone else's data.

I'm building an AI agent into The Arsenal , a platform for life insurance agents. The first version is boring on purpose: it reads performance data, answers questions, and writes nothing. But even a read-only agent sits on top of client records, so I'm working through the OWASP Top 10 for LLM applications item by item before the agent exists. This post is item two, sensitive information disclosure, and the design decisions that came out of it.

The data access layer is the only door

The model never touches the database. It calls a small set of narrow functions, things like "get my pipeline stats for this week." No generic query tool, no raw SQL, no exceptions.…