AI needs your database schema. It does not need every row.

An AI assistant needs enough database structure to form useful questions.

It does not need permission to read every row merely to learn that an approved view contains customer_id, renewal_date, and plan.

Treat schema discovery and data access as separate contracts:

• discovery lists only approved objects and safe metadata
• query reads only approved views under user and tenant scope
• sample values stay out of discovery
• metadata gets a version, source, refresh time, and expiry rule
• denied objects never appear in a “helpful” catalog dump

Prefer an allowlisted metadata projection over exposing the raw system catalog. Review comments, defaults, procedure bodies, statistics, relationships, and administrative objects explicitly—metadata can reveal sensitive business structure even without row values.

Then test the boundary. Ask for an unapproved schema, follow a relationship to a restricted table, request sample rows, pass SQL through discovery, and use stale context after a migration.

The assistant should receive enough structure to use the approved tool correctly, not enough structure to map the entire database.

Full guide: MCP database schema discovery permissions