A database connection can be read-only and still move sensitive data into places nobody approved.
The result may enter:
- an AI client's context
- a hosted model
- application traces
- an observability vendor
- a cache
- an export
- a support screenshot
The database credential controls where data can be read. It does not define where the result may go next.
That requires a data egress contract.
For every result class, define the allowed destination, purpose, region, retention, redaction, caching, export, and deletion behavior. Enforce those facts before the payload crosses the connector boundary.
Auditability does not require logging the raw result. Keep identity, tenant, operation and policy versions, normalized inputs, source watermark, row and byte counts, redaction decisions, destination class, checksum, and trace ID. Raw payload capture should be exceptional and short-lived.
Then test the uncomfortable paths: unapproved regions, aliases for sensitive fields, partial streaming, policy changes mid-session, log leakage, and deletion from caches and backups.
Scoped database access answers what may be read. An egress contract answers where that data may go next.
Full guide: MCP database access needs a data egress contract
Top comments (0)