1 · Who sees what: each Exasol role reaches a ring of data
1 · Raw outside data: CREDORA_STAGE Consent-based CIBIL, GST and AA replies, purged on time with SHA-256 proof CIBIL_CONSUMER · CIBIL_COMMERCIAL · GST_FILING · AA_ACCOUNT granted to R_ADMIN, R_DATASCI (read) · written only by R_SVC during a run 2 · Sapphire Bank's databases + all results Virtual schemas push each query down to RDS live; nothing is copied VS_CBS (Oracle core banking) · VS_CIF (MySQL customer master) · VS_LOS (PostgreSQL loans) CREDORA: DECISIONS · SCORES · FEATURES · MODEL_REGISTRY · RUN_LOG · CONFIG · all views RM_ASSIGNMENT · LOAN_STATUS_LOG · RUN_PUBLISH (written only by R_SVC) granted to R_ADMIN, R_DATASCI, R_LOANOPS (read) 3 · Relationship manager: only her assigned rows Row-level security in Exasol: views join RM_ASSIGNMENT on EXA_USER = CURRENT_USER V_RM_DECISIONS · V_RM_COMPANY (full PAN, GSTIN) · V_RM_FEATURES · V_RM_SCORES V_RM_ASSIGNMENT · V_RM_LOAN_STATUS · CONFIG · RUN_LOG V_LATEST_* and CREDORA_SEM.PORTFOLIO, filtered to her companies published runs only (RUN_PUBLISH) · no grant on DECISIONS or SCORES granted to R_RM; one Exasol user per manager (demo: CREDORA_RM = RM001) outer roles read the tables directly; the RM reads only her rows, at full detail Admin CREDORA_ADMIN · R_ADMIN + SELECT ANY DICTIONARY Data scientist CREDORA_DATASCI · R_DATASCI same reads as admin Loan operations CREDORA_LOANOPS · R_LOANOPS no CREDORA_STAGE Relationship manager CREDORA_RM · R_RM Subhashree Mohanty, RM001 Widest reach at the top. Admin and data scientist read the same data; they differ in what they may do. Grants: exasol/sql/07_security.sql, 13_rm_row_security.sql, 11_latest_run_views.sql 2 · One Ask Credora question: the role travels all the way into Exasol
1 2 3 4 5 1 role in the login token · 2 role may ask · 3 on topic · 4 MCP server starts as the role user · 5 SQL runs under that user's grants OUT no role password tool list tool calls inside grants outside grants screens jobs Signed-in person admin · datasci loanops · rm FastAPI backend checks the role (CAN) routes/ai.py Topic gate Claude answers IN / OUT _on_topic(), no tools exasol_login(role) role -> CREDORA_<ROLE> assistant.py exasol-mcp-server 2.3.0 over stdio writes switched off Exasol checks R_<ROLE> grants on every statement Refused, no query "Ask Credora only answers about Credora's analysis" CREDORA_MCP · R_MCP read-only fallback results + masked view Claude claude-sonnet-5-5 picks tools, writes SQL Rows back to Claude answer + every SQL shown to the person Exasol refuses insufficient privileges Claude says role can't see it Every web screen reads as the same role user exa.ROLE_USER: the database enforces what each screen shows RM: Exasol returns only her assigned rows (V_RM_*) Jobs run as CREDORA_SVC · R_SVC analysis, publish, assignments, loan status, CONFIG, activation, purge, memo UDF; no person logs in The prompt tells Claude what its role may read; Exasol's grants enforce it. A wrong prompt or a jailbreak cannot widen what the AI can read. 3 · The hand-off: run, publish, assign, work, track
1 2 3 4 propose policy, request activation approved policy: run + publish Data scientist Run analysis: a draft CREDORA.RUN_ANALYSIS() as CREDORA_SVC Publish CREDORA.RUN_PUBLISH: official run for loan operations, RM views and V_LATEST_* Loan operations Assign to RM, single or bulk CREDORA.RM_ASSIGNMENT (CIF, RM, EXA_USER) Relationship manager sees only her rows (V_RM_*) negotiates in the limit; above it, loan ops checks Loan status CREDORA.LOAN_STATUS_LOG tracked by admin, data scientist, loan operations Admin: Approvals policy proposals, model activations; never own ones 1 publish · 2 hand to loan operations · 3 assign · 4 log Contacted, Negotiating, Loan taken, In progress, Disbursed or Not interested, with a note Every step is audited: RUN_PUBLISH, POLICY_*, MODEL_ACTIVATION_*, ASSIGN_RM, LOAN_STATUS 4 · Each role: sees, can do, cannot, and what its AI can and cannot do
Sees everything, read-only, drafts included: results, the three bank databases, raw CIBIL/GST/AA, loan status, auditCan do bank manager: generate, append and purge mock data; approve or reject policy proposals and model activations; audit, sourcesCannot run the analysis, train, what-if, assign companies, negotiate, sanction, decide own requestsAI can join Oracle + MySQL + PostgreSQL in one query, read raw API data, run log, semantic viewAI cannot write anything, answer off-topic questionsSees same data as admin, read-only, drafts included; loan status read-onlyCan do run the analysis and publish it to loan operations, train models and request activation, what-if and propose policyCannot activate a model or change policy without the admin, generate data, assign, negotiate, sanctionAI can model registry (AUC, Gini, features), features vs grades, past loans in VS_LOS, raw API dataAI cannot write anything, answer off-topic questionsSees published runs: all results and the three bank databases; not the raw outside data; loan statusCan do assign companies to relationship managers (single, bulk, reassign), every report, verify and sanction escalationsCannot run the analysis, see drafts, generate data, train, what-if, negotiateAI can KYC from the customer master joined with decisions, core-banking credits, hard-fail countsAI cannot read CREDORA_STAGE (Exasol refuses), write anythingSees only the companies assigned to her, at full detail: report, features, unmasked PAN and GSTINCan do negotiate within the limit (above it, escalated), log loan status (Contacted to Disbursed, or Not interested), credit memoCannot see any other company, bank databases, raw API data, run, publish or assign anythingAI can headroom, lowest ROI and RAROC, her companies by loan status, through the V_RM_* viewsAI cannot read any other company: Exasol filters the rows on CURRENT_USER and refuses DECISIONS itself