Letting an LLM read your ERP safely: a read-only pattern with an approval queue