Thanks! Read-only felt like the obvious constraint; agents shouldn't need write access to understand a database.