What a read-only Postgres role does and doesn't stop when an AI agent connects

A hands-on PostgreSQL 17.11 test shows that a carefully built read-only agent role blocks writes, DDL, COPY TO PROGRAM and ungranted tables, but its read-only and timeout settings are only per-session defaults that the agent can turn off with SET or BEGIN READ WRITE, and it can even alter its own stored defaults via ALTER ROLE. The piece also shows that GRANT SELECT exposes every column, that PUBLIC can execute SECURITY DEFINER functions like refund_order, and that pg_catalog reveals schema, roles and function source, so the real boundary is the GRANTs plus external enforcement. It closes with a nine-step checklist covering column-level grants, row-level security, revoking PUBLIC EXECUTE and default privileges, and giving the agent only its own credential.