Skip to main content
TeamDuo supports three kinds of database. They are less alike than they look, so the wizard branches by type rather than pretending one set of instructions fits all. describe_datasource reports the right vocabulary per source, so an agent is never told “schema” about a MongoDB collection.

​
1. Let the wizard generate the credential

TeamDuo does not create the credential for you. The wizard generates the exact command and you run it, against your own database, authenticated as yourself:
  • PostgreSQL — a CREATE ROLE … GRANT SELECT statement
  • MongoDB — db.createUser({ roles: [{ role: "read" }] })
  • BigQuery — a service account with bigquery.dataViewer and bigquery.jobUser
Do not reuse an application role. A dedicated credential keeps TeamDuo’s activity separate in your database logs and makes revocation a single statement.
This is the first of three independent layers that keep access read-only, and the only one outside TeamDuo’s code — the one that still holds if everything else fails.

​
2. Open the network path

If your database refuses connections from unknown addresses, allowlist TeamDuo’s egress address rather than opening the port to the world. The wizard shows the address and the command for your provider — see Network access. BigQuery has no network layer to open; access is decided entirely by IAM.

​
3. Choose what to expose

Nothing is readable until you select it. Two habits pay off:
  • Expose narrowly first. It is easier to add a column later than to explain why one was visible.
  • Leave PII out unless there’s a reason. Email, phone, and address columns are rarely what an analytical question needs.
BigQuery cannot enforce column-level exposure. A dry run reports which tables a query reads, never which columns. Rather than approximate the rule, TeamDuo refuses a column-restricted BigQuery table outright and generates a CREATE VIEW instead, which puts the restriction in your own project where BigQuery enforces it. An approximation would be worse than an absence, because only the approximation gets mistaken for enforcement.

​
4. Document it

Exposure decides what an agent may read. Documentation decides whether it reads it correctly. See Documentation.

​
5. Verify

Ask an agent to describe the datasource and run one known-answer query. If the result matches a number you already trust, it’s ready for the team.