This mirrors what we found building agent-to-agent payment flows. Direct DB access for agents creates an unbounded trust surface every connection becomes a potential vector. The right pattern is a narrow intermediary layer that exposes only the operations agents actually need, with capability scoping and rate limiting built in. Agent wallets do this for payments by issuing session keys scoped to specific operations and budgets, so the agent never touches the backing infrastructure.