And you’re right in that the end user wouldn’t have access to the schema, although perhaps via prompt injection they could.