[jchanimal]

This is a reason to prefer embedded databases that only contain data scoped to a single user or group.

Then MCP and other agents can run wild within a safer container. The issue here comes from intermingling data.

[freeone3000]

You can get similar access restrictions using fine-grained access controls - one (db) user per (actual) user.