They likely don't need tenant isolation and unbound table reads can be mitigated using timeouts. We do something similar for our backoffice - just with the dif

They likely don't need tenant isolation and unbound table reads can be mitigated using timeouts. We do something similar for our backoffice - just with the difference that it is Claude that has full freedom to write queries.