2 min lesson
When the allowlist includes every database tool
Replace broad automatic database access with one exact read tool and verify the effective allowlist.
Step 1 of 3
analytics-db:* lets apply_migration run without review. The read-only database account limits the damage, but the approval boundary is still wrong.
Interactive diagram. Tab through its regions; each focused region shows its detail in the panel below.
diagram: compare
Pick a row to see what to look for.