Good catch!
more security on that part would be good.
Meanwhile the user don't have those privileges, so, we already have security barrier in that.
I include that cause in case of user try, the AI will not try and will not get an error from database.