Usually what you do with these type of LLMs is pass on most if not all of the schema in your query.

And you’re right in that the end user wouldn’t have access to the schema, although perhaps via prompt injection they could.