I recommend building an intermediary data access layer like a graphQL API that the LLM consumes, otherwise you run the risk of someone successfully tricking the LLM to drop all or part of the DB via a raw input-to-SQL step.