A reporting assistant answers questions from a customer database through one tool that executes a query. The tool handler holds a database credential that can read and write every table. A written instruction in the system prompt tells the assistant to read data and never modify it. A security reviewer states that the assistant must not be capable of modifying the database at all, while it must continue to answer the same reporting questions. Which change satisfies the reviewer?
- AAsk the assistant to include the intended operation type in its tool arguments and have the handler reject anything the assistant labels as a write, so a modifying query is turned away before it reaches the database.
- BKeep the existing credential and record every executed query in an audit store, alerting the security team whenever a statement that modifies data is observed against the reporting tables.
- CRestate the read-only restriction in the tool description as well as the system prompt, so that the constraint is visible at the point where the assistant decides how to call the tool.
- DReplace the credential the tool handler uses with one granted read permission on the reporting tables only, so that any modifying statement is refused by the database itself. Correct
Why A is wrong: A declared operation type looks like a check, but the label is produced by the model rather than derived from the query, so a mislabelled write would pass the handler and reach a credential that can execute it.
Why B is wrong: Query auditing is a sound practice and gives useful evidence, but it observes a modification that has already happened rather than preventing one, and the reviewer asked that the capability be absent.
Why C is wrong: Placing guidance in the tool description does improve how the tool is used, which is why this is tempting, but it remains a request to the model and leaves the write capability fully available to the handler.
Why D is correct: The capability is removed at the layer that enforces it, so no query the assistant can produce is able to modify data, and the reporting questions still resolve against the tables the credential can read.