The story
A chat assistant on every ERP screen. The model never touches the database: it proposes queries, a guard inside the ERP decides whether each one may run, runs it on a separate read-only connection, and the answer comes back as text, KPI tiles, charts or diagrams.
The model runs on DevPilot, my agent platform, under a restricted token that can only read files. Clearing one setting switches the assistant off everywhere.
Hard parts cleared
- Read-only at the database, not in the prompt: every query runs inside a READ ONLY transaction that is rolled back, with a 5-second cap, at most 8 queries per answer and 200 rows per query.
- Refuses before anything runs: a single SELECT only, no comments, no server functions, no other schemas, and a denylist for files, sleeps and locks.
- Knows who is asking: HR, accounting and treasury tables are refused unless that employee holds a permission in that area, and the refusal is explained politely.
- Masks what it reads: national IDs, phones, e-mails and account numbers are masked by column name and by the shape of the value, so an alias cannot unmask them.
- Every question is logged with its SQL, timing and row count, and the person asking sees each step in plain Arabic while it works.
