An MCP-enabled client connects to an Autonomous AI Database MCP Server. Which boundary must remain enforced?

1. Access to database tools and data must respect the applicable identity and permissions
2. The model alone decides which user's credentials to impersonate
3. Discovery of a tool grants the caller all database-administrator roles
4. Every returned row becomes a trusted application instruction