"Multiple layers:
- (1)Schema exposure — don't give the agent all 500 tables. Give it a curated catalog of 15-20 relevant tables with descriptions.
- (2)Query validation — the MCP server validates every query before execution: no SELECT *, no full table scans, max rows limit, timeout after 30s.
- (3)Dry-run cost estimation — BigQuery can estimate bytes scanned before running. Reject queries that would scan > 10GB.
- (4)Per-user quotas — 100 queries/day, max 50GB scanned/day.
- (5)Row-level security — query runs as the user, not a super-account."