This is really nicely, read only is the right way to start
Thanks! Read-only felt like the obvious constraint; agents shouldn't need write access to understand a database.