Why it matters
Jeff Smith describes exposing established parameterized reports through discovery and execution tools, with arbitrary SQL disabled where appropriate. This narrows query-generation errors but still leaves report-selection mistakes. He also separates read-only access from permission to read particular records and places enforcement in the database. Performance-tuning advice uses a separate environment rather than unrestricted production changes.
My takeaway: Offer a small set of reviewed report tools with documented inputs and example questions. Test wrong-report selection and invalid parameters as well as correct answers. Map authenticated user roles to database access and verify that unauthorized rows never reach agent context, including through alternate tools. Use a suitable isolated or read-only environment for diagnostics and require review before applying changes.