how are you guys handling database access for analytics/debugging agents?

Earlier this year I worked on access control for agents that query production data, mostly analytics and debugging agents. The issue I kept running into is that you can't really give these agents a normal role. An analytics agent writes a different query for every question someone asks, and a debugging agent just goes wherever the problem is. So you end up giving it more access than it needs, or it can't do its job. What I ended up doing was giving each request its own permission instead. It only covers that one query, someone or some policy has to approve it, and it expires. If the agent runs the same query again it reuses it, but anything new needs a new approval. One thing I didn't think through enough at first was checking again when the permission is used, not just when it was approved. If the agent's role or environment changed in between, the old approval shouldn't still work. I was documenting it recently and found some gaps in my own design too. For example the agent's "purpose" text was part of how a query gets identified, so if it rewords the purpose it has to get approved all over again. I put it up as an engineering record with what I considered and the gaps I found, I'll drop the link in the comments. How are you handling this? scoped roles per agent, read replicas, a human approving stuff?