Every engineering team knows this ticket: "I was charged twice."

Someone stops what they're doing, queries the database, greps the code, reads recent deploys and checks the logs. Eventually they explain the answer to support, who explain it to the customer.

I'm building TraceX , which does that investigation. To do it, it has to read production data, and the obvious reaction to "an AI reads your production database" is "absolutely not". That reaction is reasonable, so most of our design work has gone into one question:

How do you make this safe without relying on the model to behave?

Here's what we ended up with, including what's still weak. The rule behind all of it: anything that matters is enforced in code, not requested in a prompt.

1. Don't trust the credentials: check them

Asking people to "please use a read-only user" isn't a control. So TraceX checks the account's privileges when you connect, and refuses it if it can write:

SELECT EXISTS ( SELECT 1 FROM information_schema .…