The credential that helps an AI discover a database should not automatically be able to query production data.
Combining discovery and execution in one service account feels convenient. It also means a metadata refresh, indexing job, or compromised discovery component inherits live data access.
Treat them as two trust boundaries.
Discovery identity
- approved schemas, views, columns, types, and safe descriptions
- no table reads or arbitrary function execution
- no unrelated schemas or sensitive comments
- produces a versioned catalog snapshot and digest
Execution identity
- approved read operations only
- authenticated user, tenant, purpose, and environment
- database-enforced scope, statement limits, and result limits
- evidence tied to the promoted catalog digest
Promote metadata from discovery to execution. Never promote the credential.
Keep development, staging, and production identities separate. Rotate and revoke discovery and execution independently. Then test that each identity cannot do the other one's job.
A successful connection test proves that a credential works. Separation tests prove that its authority stops where it should.
Full guide: Separate discovery and execution credentials for a ChatGPT enterprise database connection
Top comments (0)