> ## Documentation Index
> Fetch the complete documentation index at: https://docs.teamduo.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect a datasource

> Point TeamDuo at a database and choose what to expose.

## 1. Create a read-only role

Give TeamDuo its own database role with `SELECT`-only grants, scoped to the schemas you
intend to expose. A dedicated role keeps TeamDuo's activity separate in your database
logs and makes revocation a single statement.

```sql theme={null}
CREATE ROLE teamduo_reader LOGIN PASSWORD '<generated>';
GRANT CONNECT ON DATABASE <your_db> TO teamduo_reader;
GRANT USAGE ON SCHEMA public TO teamduo_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO teamduo_reader;
ALTER DEFAULT PRIVILEGES IN SCHEMA public
  GRANT SELECT ON TABLES TO teamduo_reader;
```

<Warning>
  Do not reuse an application role. If TeamDuo's credentials ever need rotating, you
  want that to be a no-op for the rest of your stack.
</Warning>

## 2. Add the connection

In the dashboard, add a datasource for your team and supply host, port, database name,
and the read-only role's credentials. TeamDuo verifies the connection and reads the
schema before saving.

## 3. Select tables and columns

Choose what agents may read. Two habits pay off:

* **Expose narrowly first.** It is easier to add a column later than to explain why one
  was visible.
* **Leave PII off unless there's a reason.** Email, phone, and address columns are
  rarely what an analytical question needs.

## 4. Write the notes

For each exposed table, describe what a row represents and how it relates to other
tables. For columns whose meaning isn't obvious from the name, say what the values mean.

Good notes look like:

> `subscriptions.status` — one of `trialing`, `active`, `past_due`, `canceled`.
> `past_due` rows are still counted as active revenue until day 30.

These notes are the difference between an agent writing the query you meant and one
writing a query that merely runs.

## 5. Verify

Ask an agent to describe the datasource and run one known-answer query. If the result
matches a number you already trust, the datasource is ready for the rest of the team.