MCP database access needs a data egress contract
A database connection can be read-only and still move sensitive data into places the security team never approved.
The query result may enter the AI client's context, a hosted model, an application trace, an observability vendor, a cache, an export, or a support screenshot. The database credential controls where data can be read. It does not define where the result may go next.
Production MCP database access therefore needs a data egress contract.
Map the full result path
Start at the database and follow every copy until deletion. Include the MCP server, network boundary, client, model provider, conversation store, application backend, logs, caches, analytics, exports, backups, and incident tooling.
For each hop, record the operator, region, encryption boundary, payload class, retention period, deletion mechanism, and whether subprocessors receive the data. A diagram that stops at the MCP response is incomplete.
Classify payloads before execution
Not every result needs the same treatment. Define classes such as public, internal, confidential, personal, regulated, and secret. Bind approved operations and fields to those classes before the model selects a tool.
A revenue aggregate may be allowed in an AI context while customer email addresses require redaction, a different model boundary, or an explicit approved workflow. The policy should be deterministic and enforced before data leaves the trusted connector.
Use result redaction for AI database agents as one control, not the whole egress policy.
Separate destination from purpose
Authorization to answer a support question does not imply authorization to retain the raw result for model improvement, analytics, debugging, or future conversations.
Express purpose, destination, and retention independently. A tool request can be allowed for an interactive answer but denied for bulk export. An aggregate can be cached for five minutes while record-level details are never cached. Debug payload capture can require a time-limited incident approval.
Keep sensitive values out of observability
Auditability does not require duplicating the entire result. Log the user and workload identity, tenant, approved operation, policy version, normalized inputs, source watermark, row and byte counts, redaction decisions, destination class, result checksum, and trace ID.
Raw payload capture should be exceptional, access-controlled, encrypted, short-lived, and independently deletable. Otherwise the connector protects the database while the logging pipeline becomes the uncontrolled copy.
See the wider evidence model in audit-ready MCP database workflows.
Make residency a runtime property
A policy document that says “EU data stays in the EU” is not enough. The runtime decision should know the source region, requested destination, model endpoint, tenant policy, and payload class.
Reject or route the operation when those facts do not match. Include the effective region and destination policy in the execution receipt so reviewers can prove what happened for one request rather than relying only on architecture intent.
Concrete example: support investigation
An engineer asks an AI assistant why a customer's invoices failed. The operation needs account ID, failure category, timestamps, and a small redacted event sample. It does not need full billing addresses, payment tokens, unrelated notes, or every invoice row.
The egress contract permits the bounded redacted result in the approved model region, prohibits raw result logging, allows a five-minute encrypted cache scoped to the user and tenant, and records deletion expiry. Exporting the underlying events is a separate tool with separate approval.
Test the contract
- Request a sensitive field through a direct selection, alias, join, and free-text projection.
- Route the same operation to an unapproved region or model endpoint.
- Inspect traces, caches, analytics, and error reports for raw values.
- Force a timeout after partial streaming and verify temporary copies are removed.
- Change tenant policy during a session and verify the next dispatch reauthorizes.
- Run deletion and restore drills across primary stores and backups.
- Verify the receipt identifies payload class, destination, retention, and policy version.
Where Conexor fits
Conexor provides MCP infrastructure for connecting AI clients to databases and APIs through governed tools. A data egress contract complements scoped access by defining what may leave, where it may go, and what evidence must survive.
Explore secure AI database access
For minimizing the result at source, see ChatGPT database query data minimization.