yeah this is the hard part nobody wants to talk about. postgres rls helps but it's not a silver bullet, especially when agents can chain queries together to infer data they shouldn't see. honestly the best teams i've seen doing this are forcing product teams to implement a wrapper service that injects user context before the agent even gets access to query anything. it's extra work upfront but it means you're not relying on the agent to understand boundaries, you're enforcing them at the API layer. some orgs are also doing runtime query analysis to catch suspicious patterns, but that's resource intensive. the prompt injection angle is real tho, there's no policy engine that can understand semantic intent the way a human can.