A read-only AI database tool can block names, emails, and row exports and still reveal a person.
Examples:
- one employee in this office used the benefit
- two customers in this segment are overdue
- a regional total fell by exactly one large contract
Aggregation changes the result shape. It does not automatically remove sensitivity.
A safer aggregate contract needs:
- approved metrics and dimensions
- authenticated tenant and purpose scope
- minimum group sizes
- complementary suppression when totals reveal hidden cells
- controls for repeated, overlapping queries
- coarsened time, geography, and numeric bands
- evidence of the release policy applied
The tricky attack is differencing.
Ask for a department total. Ask again while excluding one known employee. Subtract the answers. No row was returned, but a row-level fact escaped.
That means validation cannot inspect only one query. It needs privacy-relevant fingerprints across the request sequence without copying raw sensitive results into logs.
And if a breakdown is suppressed, the model must not infer the missing cell or describe the visible table as complete.
Full guide: MCP database aggregate disclosure controls
Top comments (0)