Every AI feature your organisation ships eventually lands on your data platform. Chatbots, RAG pipelines, autonomous agents and MCP servers all show up as connections, logins and queries, but unlike human users, they write their own SQL, follow instructions from untrusted input, and can’t explain why they asked for what they did. To your database engine they look like any other session. That’s the problem.

We’ll threat-model the integration patterns DBAs now get asked to support: RAG over operational and analytical data, vector search inside the database, tool-calling agents, and MCP servers sitting in front of SQL. For each one we’ll trace the path from prompt to query plan, find where trust gets assumed, and look at what an attacker gains through prompt injection, poisoned context, over-privileged service accounts, or retrieval that returns more than it should.

The second half is controls at the layer you own: dedicated agent logins with least-privilege permissions, row-level security and masking that hold no matter what the model decides, read-only and resource-governed connections, auditing that ties every query back to a specific agent and request, and detection for anomalous agent query patterns. Practical, platform-agnostic, and built for the people who’ll be on call when the agent goes rogue.