A database count can still reveal the row you tried to hide

A read-only AI database tool can block names, emails, and row exports and still reveal a person.

Examples:

• one employee in this office used the benefit
• two customers in this segment are overdue
• a regional total fell by exactly one large contract

Aggregation changes the result shape. It does not automatically remove sensitivity.

A safer aggregate contract needs:

• approved metrics and dimensions
• authenticated tenant and purpose scope
• minimum group sizes
• complementary suppression when totals reveal hidden cells
• controls for repeated, overlapping queries
• coarsened time, geography, and numeric bands
• evidence of the release policy applied

The tricky attack is differencing.

Ask for a department total. Ask again while excluding one known employee. Subtract the answers. No row was returned, but a row-level fact escaped.

That means validation cannot inspect only one query. It needs privacy-relevant fingerprints across the request sequence without copying raw sensitive results into logs.

And if a breakdown is suppressed, the model must not infer the missing cell or describe the visible table as complete.

Full guide: MCP database aggregate disclosure controls