read only user? seems trivial? but the AI agent can just use the app to execute writes then it's a no-win situation. Give it a database that is a copy of production data instead - problem solved.