1. Create a read-only role
Give TeamDuo its own database role with SELECT-only grants, scoped to the schemas you
intend to expose. A dedicated role keeps TeamDuo’s activity separate in your database
logs and makes revocation a single statement.
Do not reuse an application role. If TeamDuo’s credentials ever need rotating, you
want that to be a no-op for the rest of your stack.
2. Add the connection
In the dashboard, add a datasource for your team and supply host, port, database name,
and the read-only role’s credentials. TeamDuo verifies the connection and reads the
schema before saving.
3. Select tables and columns
Choose what agents may read. Two habits pay off:
- Expose narrowly first. It is easier to add a column later than to explain why one
was visible.
- Leave PII off unless there’s a reason. Email, phone, and address columns are
rarely what an analytical question needs.
4. Write the notes
For each exposed table, describe what a row represents and how it relates to other
tables. For columns whose meaning isn’t obvious from the name, say what the values mean.
Good notes look like:
subscriptions.status — one of trialing, active, past_due, canceled.
past_due rows are still counted as active revenue until day 30.
These notes are the difference between an agent writing the query you meant and one
writing a query that merely runs.
5. Verify
Ask an agent to describe the datasource and run one known-answer query. If the result
matches a number you already trust, the datasource is ready for the rest of the team.
