Giving executives a database without giving them SQL
A warehouse nobody can query is a filing cabinet. Here is how a read-only MCP server put a Postgres warehouse directly in a founder's hands, and the permission model that lets you sleep at night after doing it.
The last mile is the whole problem
You can build a clean warehouse, integrate every revenue system, resolve every entity, and still deliver nothing of value. The reason is boring and universal: the person who most needs to ask questions of the data is the person least able to write SQL.
The usual answer is a dashboard. Dashboards answer the questions you predicted at build time. The questions that actually matter tend to arrive unpredictably, in the middle of a decision, in the shape of "hold on, how many of those came from the webinar and did any of them actually pay".
Every one of those becomes a request to a technical person, who becomes a bottleneck, and the data goes back to being someone else's job.
What an MCP server changes
The Model Context Protocol lets an AI assistant call defined tools against your systems. Building a custom MCP server for the warehouse and connecting it to Claude as an organization connector meant the founder could open a Claude Project and simply ask, in plain English, about their own business.
No SQL. No dashboard maintenance. No new interface for anyone to learn, because the interface is a conversation, and the model translates intent into queries against a schema it can inspect.
The important design decision is what the server is allowed to do, which is much less than people expect.
The permission model, stated plainly
Handing an AI a database connection is where this goes badly wrong, so the constraints were deliberate and layered:
Dedicated AI database roles. The AI does not use an application credential. It uses roles created for it, with grants issued explicitly.
SELECT only, and only on the view layer. The roles cannot read staging or core at all. They see the governed views and nothing else. Raw payloads and typed source records are structurally out of reach, not merely discouraged.
Enforced read-only transactions. Even if a statement somehow attempted a write, the transaction context refuses it.
Single-statement guardrails. No chained statements, which closes the obvious injection-shaped door.
Read that list again and notice what it means: the worst realistic outcome of the AI layer misbehaving is a wrong answer, not a damaged database. Wrong answers are recoverable. Mutated production data is not.
Why the view layer earns its keep here
The three-layer architecture was designed before the AI layer existed, and it turned out to be what made the AI layer safe. Because the logic layer is the single read surface for humans, it was already the correct read surface for a model.
There is a second benefit that matters more over time. A view encodes the business definition of a thing. When the AI answers a question about sales, it uses the same definition of "sale" that the executive dashboard uses, because they are reading the same view. The alternative, letting a model roam raw tables and invent its own joins, produces answers that are confidently inconsistent with your reporting. That erodes trust faster than having no AI layer at all.
Governance is a feature, not a tax
It is tempting to treat access control as the boring part you do after the interesting part works. In practice it is the thing that determines whether the interesting part survives contact with a real company.
A non-technical stakeholder will only keep using a system they trust. Trust here is not a feeling, it is a property you build: consistent definitions, a read surface that cannot lie about itself, and an AI that structurally cannot damage what it reads.
The outcome worth measuring
The measurable result is not a benchmark. It is that questions stopped queuing. An executive asking their own follow-up question, immediately, at the moment the decision is being made, is a different operating tempo than filing a request and waiting.
That is the actual deliverable of an AI access layer, and it only exists if the plumbing underneath is disciplined enough to deserve it.
Want an AI access layer over your own data? Get in touch.