{
  "profile": "finance-analyst-readonly",
  "account_label": "SANDBOX-demo (fictitious)",
  "notes": "Start read-only. Promote tools only after reviewing MCP logs for two closes. Never use Administrator with MCP (Oracle blocks it).",
  "deny_tools": ["ns_executeRecordAction", "ns_createRecord", "ns_updateRecord", "ns_transformRecord", "ns_attachFile", "ns_detachFile"],
  "require_session_check": true,
  "environment": "sandbox"
}