My AI Agent Never Touches the Database

Description and use

An AI agent in The Arsenal platform reads data via a secure, read‑only interface, never touching the database directly, to prevent sensitive data disclosure

Problem

Prevent sensitive data disclosure by an AI agent that only reads data

Outcome

The agent never touches the database directly; all data access is mediated by a secure layer that enforces identity, column tagging, and error handling, effectively preventing sensitive information disclosure

Workflow

• 1. User asks a question via the agent
• 2. Agent formulates a function call with parameters (e.g., lead ID) but no user identity
• 3. Data access layer stamps caller identity from session and filters rows
• 4. Function declares required data tier; layer returns only columns tagged public or production
• 5. If a column lacks a tag it is treated as PII and omitted
• 6. Errors are generic; detailed logs contain request IDs
• 7. Existence leaks are mitigated by returning the same error for out‑of‑scope lookups
• 8. Transcripts and logs are subject to the same controls and purged after 30 days

Evidence

The model never touches the database. It calls a small set of narrow functions, things like "get my pipeline stats for this week."

Source

Every column in the schema carries one tag: public, production, or client PII. Each function declares its tier, and the data layer refuses to return anything above it.

Source

Error messages: users see a generic message; the real error goes to a server log with a request ID.

Source