Securely Connecting Claude to Internal Resources: A Reference Architecture for Database and Filesystem Integration

Abstract. Large language model assistants have moved from advisory tools to agentic systems that read files, execute commands, and query production databases under delegated authority. This shift invalidates a core assumption of conventional application security: that the caller is deterministic code whose control flow was reviewed before deployment. When the caller is a language model, the instruction channel and the data channel are the same token stream, and no amount of prompt hardening reliably separates them. This article surveys the threat surface created by connecting Claude — through the Model Context Protocol (MCP), through agentic coding clients such as Claude Code, and through direct tool-use APIs — to internal databases and filesystems. It then proposes a defense-in-depth reference architecture whose central claim is that all security-relevant enforcement must occur below the model, in systems the model cannot argue with. Concrete control sets are given for relational database access and filesystem access, followed by a treatment of detection, assurance, and governance mapping. The article closes with open problems, including the unresolved tension between agent utility and the structural vulnerability known as the lethal trifecta.

Keywords: agentic AI security, Model Context Protocol, prompt injection, tool poisoning, least privilege, row-level security, sandboxing, non-human identity

1. Introduction

The practical value of an AI assistant inside an organization is roughly proportional to what it can reach. An assistant that cannot see the student information system, the finance warehouse, or the shared document store is a well-read stranger; one that can see them becomes an analyst. Every integration that increases utility, however, also increases the consequences of a successful manipulation, and the manipulation vector for language models is not a memory-corruption bug or an injection flaw in a query builder. It is text.

This is the asymmetry that makes agentic integration a distinct security discipline rather than a special case of API security. Traditional API security assumes an authenticated caller executing reviewed code against known endpoints with validated inputs. An agentic deployment inverts two of those assumptions. The caller is a probabilistic model that decides at runtime which tool to invoke and with what arguments, and the inputs it reasons over include content the organization does not control: web pages, uploaded documents, ticket bodies, database text fields, package README files, and the descriptions advertised by third-party tool servers.

The consequence is that controls expressed as instructions to the model — system prompts, tool descriptions that say “never access PII,” policies written in natural language — are user-experience features, not security boundaries. They express intent. They do not constrain capability. This article’s organizing principle follows directly: enforce in the engine, not in the prompt.

The scope here is deliberately narrow. It concerns the connection between a Claude-based agent and two categories of internal resource: relational databases and filesystems. These two are chosen because they are the most commonly integrated, the most sensitive, and the most instructive — filesystem access is where credential theft happens, and database access is where regulated data lives.

Solving America’s Daycare Crisis: A Proven Digital Solution Ready for Implementation

The Problem is Real, and So is the Solution

Across America, daycare centers are drowning in paperwork, losing critical records, and facing regulatory compliance nightmares. Parents struggle with outdated sign-in processes, administrators waste countless hours on manual data entry, and government oversight becomes nearly impossible with fragmented, paper-based systems. But what if I told you this problem has already been solved?

Skagit Valley College Student Document Repository

If the Financial Aid Department is the heart of the college institution, then the Skagit Valley College was suffering from a stroke. The heart was clogged up from the result of years of managing paperwork using tried and true ancient techniques: the in person delivery of hand filed paper forms.

And then corona virus came to deliver the death blow. Due to the pandemic, the college campus was forced to close. Unable to allow students to come to campus and process in person financial aid meant that our college might suffer the same fate as several other Washington State institutions and be shut down completely.

They came to me with this problem desperate for a solution. They needed a document repository that could be integrated with our current Legacy student management system data, but that will also be able to transition with our data over the next few years as the school completes its move to a new student data management system. They needed a way to assign the forms to the students, and a portal where students could securely upload their documents.

The college had a legacy document storage system in place, aging and in need of replacement. The system had fallen out of development and was no longer being supported. The decision was to either purchase an expensive out of the box system, or develop one in-house. Due to the success of previous projects, the President of SVC decided to have me develop a custom in-house document storage and management solution that would be easily integrated into our student data management system.

During the planning phase, the project management documents were drawn up, key deliverables determined, and the use case scenarios developed.

A screen shot of the student document repository user interface.

Throughout the software development life cycle, those documents were referred to in order to prevent feature / scope creep from setting back the projected completion date. Using Agile project management I completed several sprints of user story backlogs, and the scrum retrospectives revealed valuable lessons learned about the techniques used to program the application.

In the midst of the pandemic, forced into working remotely, I was under the pressure to save the college by finishing my application well ahead of the projected schedule.

The project close was met with very satisfied stake holders, and the project sponsor was happy to sign off the completed product.

Student Club Roster Form

I was assigned the task of turning the Student Club Roster Form paperwork into a paperless web application. This was a challenging project involving a lot of dynamic elements and on the fly data validation.

I created a day of the week chooser to hide some intrusive and unintuitive form checkboxes and turn it into a slick ui with a responsive modern design.

See this post for more information about the day of the week chooser.

I. T. Project Request Form

The head of the I.T. Department at Skagit Valley College asked me to convert the paper form that was used for submitting an I.T. Project Request. I used my 3DW DevCloud Tools to whip out this project in a small amount of time. My project management cloud is the perfect way to track and complete this project. As you can see from the tabs in the screen shot, I’m logged into my DevCloud, and have my task lists, notes and planning documents right at my fingertips. These powerful tools allow me to compete projects quickly and efficiently, using the best practices and techniques I have honed through the years of web application development at Skagit Valley College.