I’m dealing with invoices and customers and timesheets and tickets. I didn’t want to give an agent SQL access to the database for performance and security reasons, and we don’t have a read only replica (which would have been much more acceptable to give read access to). So my tools are get_invoices etc. and they pull data into the SQLite.

My use case is a short conversation to answer a question like “has all the time from this task been invoiced?” Or “what contributed to the size of this invoice!”. So my agent starts with empty SQLite, fetches the data into SQLite, writes queries to answer the question, then user can continue to interrogate but eventually shuts down.

I don’t have a perpetually running agent so I haven’t had to solve that problem.

What could go wrong? Delete production data. Corrupt production data. Show staff member info they shouldn’t have. Show customer info they shouldn’t have. Rely too much on the LLM doing the right thing, it doesn’t, and the agent presents the wrong information without knowing. Bugger up the security and anyone can use the agent to query production data. … Yeah, be cautious.