The difference is Retool still basically trusts whoever (or whatever) is building the app, we don't. The agent writing the code never sees a credential and each tool gets its own Postgres role. Even if it generates something dumb it physically can't touch data outside its scope.