The usual choice is all-or-nothing: either the agent can run queries or it cannot. Tagging queries and issuing a token that only reaches one tag means a reporting assistant and an operational one can share a platform without sharing a blast radius — and the boundary is visible in the tags, which someone can audit. Free tier with no card makes it easy to check whether the model fits.
Kvery's endpoint over their query platform. The interesting property is the token model: a scoped token restricts what the connection can run.
The platform's query surface, run under your account's permissions. The endpoint requires a key before listing, so we could not enumerate it.
An API key. There is a free-forever plan with no card. Data is encrypted with AES-256, and scoped tokens limit a connection to queries carrying particular tags.
Paste a URL with a key — add the endpoint to your client