# Should a read-only database task use credentials that can write data?

Canonical URL: https://help.iagenify.com/faqs/databases/should-a-read-only-database-task-use-credentials-that-can-write-data

[← Back to Databases FAQs](https://help.iagenify.com/faqs/databases)

HELP CENTER · FAQ Databases 2 min read
# Should a read-only database task use credentials that can write data?
Database permissions should reflect what the task needs to do. Separating read-only work from write-capable operations limits the impact of a mistake and makes an agent's or workflow's authority easier to review.
IaGenify
Databases

## Match access to the operation
For reporting, lookup, or question-answering tasks, identify the tables or collections that must be read and use a connection without write privileges where possible. A task that does not need to change records should not inherit update or delete access merely because it is convenient to reuse a broad connection.
If a workflow includes both reading and writing, consider separating those responsibilities into distinct steps or connections. The read step can gather the information it needs, while a later write step uses only the permissions required for its specific action. This makes the boundary visible during configuration and review.
## Review write operations as a separate decision
Before enabling a task to create, update, or remove records, specify which records it may affect and how the result will be checked. Test the operation against a separate environment and inspect its target before using production data. An explicit approval or human review is useful when a change is consequential or difficult to reverse.
Revisit access when the task changes. A connection that was appropriate for a read-only report may become too permissive if the workflow later adds writes. Keep connection names and purposes clear, and remove permissions that are no longer needed so each task remains limited to its current role. [← Back to Databases FAQs](https://help.iagenify.com/faqs/databases)