An AI agent that can query your database can usually read all of it. Here you pick the fields it may see, and the rest is not filtered out of the answer — the decryption key for those fields is never created, so there is nothing for the agent to read.