Connect AI documentation · Full API reference & configuration details

Workspace isolation & least-privilege

Don't give your agent a connection that can see everything. Provision a dedicated workspace per agent (or per environment), grant only the data sources and tables it needs, and scope the PAT to that workspace. If the agent is compromised, the blast radius is what that workspace can see, nothing more.

For multi-tenant agents, model one workspace per tenant and switch credentials per request rather than filtering inside the agent. The boundary lives in Connect AI, not in your prompt.

References: Workspaces for setup, and Permissions for table- and column-level grants.