Giving a model database access is enormously useful and quietly dangerous. The same flexibility that lets it answer a question lets it run one it shouldn’t.
We never let a model talk to a database directly. It proposes; a constrained layer disposes - parameterized, scoped to least privilege, and screened for injection and high-risk operations using the same ML auditing we ship as a service.
Every action is logged with the prompt that produced it. If something looks wrong, you can trace it from natural language to SQL to row. That traceability is what makes AI database access defensible, not just impressive.