PostgreSQL 19 features I'm excited about: planner advisor framework, DDL extraction, online REPACK, pg_stat_recovery, parallel autovacuum, sequence sync, and 64-bit MultiXact.

PostgreSQL 19 features I'm excited about

Bytebase is HIPAA-compliant — independent verification that our administrative, physical, and technical safeguards meet the HIPAA Security Rule for handling Protected Health Information.

HIPAA Compliance

PAM tools gate connections; databases also need SQL review, schema change workflow, and statement-level approval. Why most teams use PAM with Bytebase.

Bytebase vs. PAM: Why Database Teams Need More Than Privileged Access Management

The difference between 'audit logging enabled' and 'audit evidence your SOC 2 auditor will accept' — what we learned going through our own SOC 2 audit, and what we built in response.

What SOC 2 Taught Us About Database Audit Logs

Bytebase vs. Atlas compared across migration approach, CI/CD, access control, and pricing. Updated for Atlas v1.1 and Bytebase 3.16.

Bytebase vs. Atlas: a side-by-side comparison for database schema migration

Best practices for database access control covering least privilege, RBAC, just-in-time access, and compliance with SOC 2, HIPAA, and GDPR.

Database Access Control Best Practices

SOX Section 404 requires IT general controls over database changes. Learn the ITGC domains, six audit questions teams fail, and how to build SOX-ready controls

Database Change Management for SOX Compliance

TRUNCATE and DELETE both remove rows, but they differ in speed, rollback behavior, and locking. Compare how they work in PostgreSQL, MySQL, and SQL Server.

TRUNCATE vs DELETE in SQL: Differences Across PostgreSQL, MySQL, and SQL Server

Six database design patterns for production systems: normalization, star schema, EAV, polymorphic associations, multi-tenancy, and anti-patterns.

Database Design Patterns Every Developer Should Know

pgvector adds vector storage and similarity search to PostgreSQL. Learn how to install it, query embeddings, build indexes, and decide when it is enough.

pgvector: How to Add Vector Search to PostgreSQL

Upsert inserts or updates a row based on key conflicts. Learn MySQL INSERT ON DUPLICATE KEY UPDATE, PostgreSQL ON CONFLICT, and SQL Server MERGE.

Upsert in SQL: INSERT ON DUPLICATE KEY vs ON CONFLICT Explained

How codifying the full database development lifecycle — not just DDL — empowers LLMs and AI Agents.

From Schema as Code to Schema as Context

Learn how to find and fix slow MySQL queries using the slow query log, EXPLAIN, index tuning, and query rewrites, with practical examples for each.

How to Fix Slow MySQL Queries: A Practical Guide

A detailed comparison of Convex and Supabase covering architecture, real-time capabilities, data model, pricing, and schema management to help you choose.

Convex vs Supabase: Which Backend Platform Should You Choose?

Blue-green deployments work cleanly for stateless apps. Databases are stateful. Learn what makes database blue-green deployments hard and how to do them safely.

Database Blue-Green Deployment: A Practical Guide

The 10 best data management tools in 2026 — database GUI clients, schema migration tools, data pipelines, and analytics platforms compared with pricing.

Top 10 Data Management Tools in 2026

A practical guide to governing AI agent access to enterprise databases — covering authentication, authorization, query control, audit logging, and data masking.

How to Govern AI Agent Access to Enterprise Data

Postgres-only SQL editors are designed specifically for Postgres databases, providing a more focused and efficient experience for Postgres users. In this post, we are taking a look at the top Postgres-only SQL editors in 2026.

Enterprise Text-to-SQL: Context, Evaluation, and Governance for Consistent Results

Database deployment tools for devops teams in 2026.

Database Deployment Tools for DevOps Teams in 2026

Schema change detection and notification are essential for data pipelines. This article explains why a simple column rename can break your data pipeline and how to prevent it.

Schema Change Detection and Notification: Why a Simple Column Rename Can Break Your Data Pipeline

A comprehensive guide to understanding and analyzing Postgres query plans.

Postgres Query Plan: How to Read and Fix Performance Issues

This article explores the anatomy of Postgres permissions ERROR 42501.

The Anatomy of Postgres Permission ERROR 42501

Postgres Logs Explained: A Practical Guide for Production

Postgres 19 widens MultiXactOffset to 64 bits, eliminating the hidden 4 billion member limit that caused catastrophic outages for high-concurrency workloads.

Postgres 19 Feature Preview: 64-bit MultiXactOffset

A guide to MySQL schema migration best practice.

MySQL Schema Migration Best Practice

Postgres 19 introduces automatic sequence synchronization for logical replication, eliminating manual tracking and making major version upgrades and failover significantly easier.

Postgres 19 Feature Preview: Sequence Synchronization for Logical Replication

A guide to multi-environment deployments in databases.

Database Multi-Environment Deployments - The Challenges and Patterns

A guide to open source sensitive data discovery tools - from lightweight CLI scanners like PiiCatcher and Hawk-Eye to full data platforms like OpenMetadata.

Top Open Source Sensitive Data Discovery Tools in 2025

How to set up database audit logging for SOC 2, HIPAA, and ISO 27001 compliance across PostgreSQL, MySQL, SQL Server, and Oracle.

Database Audit Logging Best Practices for Compliance

A practical guide to HITRUST database compliance covering access control, audit logging, change management, and data protection.

Database Compliance for HITRUST: Controls, Risks, and Best Practices

Learn why requiring a primary key is important and how the "Require Primary Key" review rule protects your production database.

SQL Review Rule Explained - Require Primary Key

Learn why enforcing NOT VALID in CHECK constraints is important and how the "Enforce NOT VALID in CHECK" review rule protects your production database.

SQL Review Rule Explained - Enforce NOT VALID in CHECK

Postgres Audit Logging Guide

Learn why CASCADE operations in SQL can lead to catastrophic data loss and how the "Prohibit CASCADE" review rule protects your production database.

SQL Review Rule Explained - Prohibit CASCADE

A comprehensive guide on migrating from Supabase to AWS, covering database, auth, storage, functions, realtime, and networking.

How to Migrate from Supabase to AWS

Top open-source Postgres backup solutions for 2026.

What is Enterprise Database Management (EDM)?

What is Postgres Transaction ID (XID) Wraparound and how to monitor and prevent it.

Postgres Transaction ID (XID) Wraparound

A comprehensive guide on building a CI/CD pipeline for automated database schema migration, covering best practices, tools, and implementation strategies.

How to Build a CI/CD Pipeline for Database Schema Migration

A practical guide to shipping features efficiently using PostgreSQL, covering development workflows, best practices, and real-world examples

How I Ship Features with Postgres

A comprehensive overview of the essential practices and principles necessary for achieving LGPD (Brazilian General Personal Data Protection Act), compliance within database operations, and its difference with GDPR

Database Compliance for LGPD: Implications and Best Practices

Explain what is Postgres LATERAL JOIN and how to use it.

What is Postgres LATERAL JOIN?

Introduction to MySQL Online DDL and its three algorithms: INSTANT, INPLACE, and COPY

MySQL Online DDL: A Practical Guide

List of open source postgres connection poolers

Open Source Postgres Connection Pooler

A comprehensive guide to understanding the dilemma of singular vs. plural table naming in SQL databases.

SQL Table Naming Dilemma: Singular vs. Plural

PostgreSQL 18 features that change how application developers write and ship code.

What's New in PostgreSQL 18: A Developer's Perspective

Explore Snowflake Dynamic Data Masking capabilities and compare with alternative data masking solutions

Snowflake Dynamic Data Masking (DDM) and Alternatives

Top open-source Postgres authentication solutions for 2025.

Postgres Case Sensitivity Explained

A comprehensive guide to understanding pg_database_owner in Postgres

What is pg_database_owner in Postgres

Which operation causes a Postgres table rewrite

Which Postgres Operation causes a table rewrite

An engineering perspective to evaluate Postgres row-level-security footguns

Common Postgres Row-Level-Security footguns

An engineering perspective to evaluate Postgres rollback strategies

Postgres Rollback Explained

Learn how Postgres locks affect schema migrations and which DDL operations conflict with DML to achieve zero-downtime deployments.

Postgres Schema Migration without Downtime Best Practice

A checklist of gh-ost limitations and potential gotchas

gh-ost Limitations You Need to Know Before Production

5 quick wins for application developers to improve Postgres reliability and make both their own and DBA/infrastructure teams' lives easier.

5 Postgres Production Tips for Application Developers

Learn how to use CREATE INDEX CONCURRENTLY in Postgres to build indexes without blocking writes. Pitfalls, safety checks, and performance tips.

How to Use Postgres CREATE INDEX CONCURRENTLY

An extensive comparison between Supabase and MongoDB on performance, usability, operability, ecosystem and more.

Supabase vs. MongoDB: a Complete Comparison in 2025

When evaluating database management tools, DataGrip and Bytebase represent two different philosophies: individual developer productivity versus team collaboration and governance.

Bytebase vs. DataGrip: a side-by-side comparison for database management

Supabase pricing starts free. We break down real costs for Pro ($25/mo) and Team ($599/mo) plans, explain overages, and compare each service head-to-head with AWS.

Supabase vs AWS: Feature and Pricing Comparison (2026)

Is Supabase free? Compare Supabase pricing vs AWS RDS and Aurora across free tier, Pro, and production plans. Includes Supabase free tier limits, storage costs, and compute pricing for 2026.

Supabase Pricing vs AWS RDS: Is Supabase Free? Full Cost Comparison (2026)

Learn how Bytebase enables organizations to implement comprehensive Database Security Lifecycle Management, unifying security and operations from development to production.

Database Security Lifecycle Management

Areas where MySQL shines and Postgres falls short.

Features I Wish Postgres Had but MySQL Already Has

Areas where PostgreSQL shines and MySQL falls short.

Features I Wish MySQL Had but Postgres Already Has

This guide focuses on HIPAA compliance at the database layer, providing healthcare organizations and database teams with practical guidance for implementing HIPAA Security Rule requirements.

HIPAA Data Security and Retention Requirements

Compare the online index creation difference between Postgres and MySQL

Postgres vs. MySQL: Online Index Creation

SOC 2 Data Security and Retention Requirements for Database Systems and How Bytebase Helps

SOC 2 Data Security and Retention Requirements

Compare the different indexing options between Postgres and MySQL

Postgres vs. MySQL: Indexing Options

Compare the JSON support difference between Postgres and MySQL

Postgres vs. MySQL: JSON Support

While PostgreSQL RLS is a powerful feature, it has inherent design limitations that hinder broader adoption. In this post, we’ll examine these limitations and explore alternatives.

PostgreSQL Row-level Security (RLS) Limitations and Alternatives

Evaluate several database schema diagram tools, and help you to choose the right one for 2025

Top 4 Free, Open Source Database Schema Diagram Tools to Visualize Database Easier in 2025

An overview of the most popular text-to-SQL AI tools in 2026, including DataGrip, TablePlus, SQL Chat, Vanna.ai, SQLAI.ai, Postgres.new, and DBHub MCP server. Compare features and capabilities to find the best SQL AI assistant for your workflow.

Top 5 Text-to-SQL Query Tools in 2026

Compare the DDL transaction difference between Postgres and MySQL

Postgres vs. MySQL: DDL Transaction Difference

Evaluate several TypeScript ORMs, and help you to choose the right one for 2025

Top TypeScript ORM 2025

Evaluate Prisma and TypeORM, and help you to choose the right TypeScript ORM for 2025

Prisma vs TypeORM: The Better TypeScript ORM in 2025

PostgreSQL 18 features and what they change for running production databases.

What's New in PostgreSQL 18: A DBA's Perspective

Explore alternatives to Amazon RDS, including 

RDS Alternatives in 2025

An extensive comparison between DynamoDB and Cassandra on performance, usability, operability, ecosystem and more.

DynamoDB vs. Cassandra: a Complete Comparison in 2025

An extensive comparison between DynamoDB and MongoDB on performance, usability, operability, ecosystem and more.

RDS vs. DynamoDB: a Complete Comparison in 2025

gh-ost and pt-online-schema-change are two popular tools for online schema migration in MySQL. This article compares the features and capabilities of the two tools.

gh-ost vs pt-online-schema-change in 2025

GitHub and Bitbucket are both tools for code collaboration. This article compares the features and pricing of GitHub and Bitbucket.

GitHub vs Bitbucket:a Complete Comparison in 2025

Drizzle ORM vs Prisma comparison: type safety, performance, bundle size, serverless support, migrations, and ecosystem. Find out which TypeScript ORM is right for your project in 2026.

Drizzle ORM vs Prisma: Which TypeScript ORM Should You Use in 2026?

An engineering perspective to evaluate Google AlloyDB and Cloud SQL, and help you to choose the right Google Cloud database for 2025

AlloyDB vs. Cloud SQL: engineering guide to choose the right Google Cloud database for 2025

Understanding DynamoDB Pricing (2025)

A simple comparison of AWS Aurora versus RDS pricing in 2025, helping you understand key differences and choose the right database service for your needs and budget.

AWS Aurora vs. RDS Pricing: A Detailed Comparison 2025

Infrastructure as Code security tools help organizations identify vulnerabilities and misconfigurations in their infrastructure definitions. This post explores the top open-source IaC security tools available in 2025.

Top Open Source Infrastructure as Code (IaC) Security Tools in 2025

Compare the price of the mainstream managed PostgreSQL hosting providers

PostgreSQL Hosting Options in 2025: Pricing Comparison

Complete guide to AWS Aurora pricing: instance types and costs, Aurora Serverless v2 pricing, I/O-Optimized vs Standard, reserved instance savings, and real-world cost examples. Learn how to optimize your Aurora costs.

AWS Aurora Pricing Explained: Instance Types, Serverless, and Cost Optimization (2026)

Database governance tools help organizations manage database changes, enforce policies, and maintain data quality. This post explores the top open-source database governance tools available in 2025.

Top Open Source Database Governance Tools in 2025

Workflow orchestration tools help coordinate tasks, handle errors, and monitor execution processes. In this post, we are taking a look at open source workflow orchestration options

Top Open Source Workflow Orchestration Tools in 2025

Understanding AWS RDS Pricing (2025)

Compare the price of the mainstream managed MySQL hosting providers

MySQL Hosting Options in 2025: Pricing Comparison

A comprehensive guide to the best open-source Kubernetes cluster management tools in 2025, including Argo CD, Karmada, Sveltos, and Plural.

Top 4 Open Source Kubernetes Cluster Management Tools in 2025

An extensive comparison between GitLab CI and GitHub Actions on features, performance, and more.

GitLab CI vs. GitHub Actions: a Complete Comparison in 2025

Review the state of the Golang ORM and query builder

Choose the Right Golang ORM or Query Builder in 2025

Overview of MySQL 9 features with spicy comments

What's New in MySQL 9 - a DBA's Perspective

An extensive comparison between Oracle and PostgreSQL on data model, query language, scalability, performance, and more.

Oracle vs. PostgreSQL: a Complete Comparison in 2025

An extensive comparison between MongoDB and MySQL on data model, query language, scalability, performance, and more.

MongoDB vs MySQL: a Complete Comparison in 2025

An extensive comparison between MongoDB and Redis on performance, usability, operability, ecosystem and more.

MongoDB vs Redis: a Complete Comparison in 2025


Teams adopt Privileged Access Management (PAM) — CyberArk, BeyondTrust, [StrongDM](/blog/bytebase-vs-strongdm/), Teleport, HashiCorp Boundary — to solve the "who can SSH into which server" problem. The model works: vault credentials, broker connections, record sessions, enforce [just-in-time access](/blog/just-in-time-database-access/). Then they hit databases. The same tool gates the connection but stops being useful at the part that actually matters: what someone does once connected. The most common outcome is not a replacement decision — it's adding a database-native layer alongside PAM.

## Bytebase vs. PAM at a glance

The "PAM" column describes the typical posture across CyberArk, BeyondTrust, StrongDM, Teleport, and HashiCorp Boundary. See the [vendor landscape](#pam-vendor-landscape) for tool-specific notes.

|  | PAM (typical) | Bytebase |
| --- | --- | --- |
| [Primary category](#what-pam-does-well) | Privileged access management for infrastructure | Database DevSecOps |
| [Infrastructure scope](#what-pam-does-well) | Servers, Kubernetes, cloud consoles, web apps, databases | Databases (30+ engines: PostgreSQL, MySQL, Oracle, SQL Server, MongoDB, etc.) |
| [Credential vaulting](#what-pam-does-well) | ✅ Infrastructure-wide (DBs, SSH, cloud, web) | ✅ For database credentials |
| [JIT database access](#where-pam-falls-short-for-databases) | ✅ Time-boxed connection access | ✅ Time-boxed access + per-query approval |
| [SQL review on the actual SQL](#where-pam-falls-short-for-databases) | ❌ | ✅ 200+ rules, checked before each statement runs |
| [Schema change workflow](#where-pam-falls-short-for-databases) | ❌ | ✅ Ticket-tracked rollout (dev → staging → prod) with rollback |
| [Per-query approval](#where-pam-falls-short-for-databases) | ❌ Approve the connection, not the query | ✅ Approve specific queries (e.g., DELETE on a large table) |
| [Audit log of executed SQL](#where-pam-falls-short-for-databases) | ⚠️ Session video replay | ✅ Searchable per-statement log (user, time, rows affected) |
| [Data masking](#where-pam-falls-short-for-databases) | ❌ | ✅ Per-column rules applied at query time (e.g., redact email) |
| [Web SQL editor with autocomplete](#where-pam-falls-short-for-databases) | ⚠️ Some (StrongDM, Teleport) | ✅ Built-in, with schema browser and query history |

## What PAM does well

PAM grew out of Unix administration. The mental model is "credentials are dangerous, so put them behind a broker," and every major vendor implements the same core capabilities:

- **Credential vaulting** — passwords, SSH keys, cloud tokens never live on developer laptops
- **JIT access broker** — request, approve, short-lived token, auto-revoke
- **Session recording** — keystrokes for SSH, network capture for DB protocols, screen capture for web consoles
- **Identity integration** — SSO, group-based policy, MFA enforcement
- **Connection-level audit** — who accessed what, when (not what they did)

For SSH into a Linux server, `kubectl exec` into a pod, or RDP into a Windows admin host, this is the right model. The high-value control is "did anyone unauthorized connect?" and PAM answers that question well.

## Where PAM falls short for databases

The same connection-level model that works for SSH falls apart on databases, because the high-value question shifts from "who connected?" to "what did they run?" Five concrete gaps show up in production:

### 1. No SQL review on the actual SQL being executed

PAM gates the connection. Once you're in, you can run anything the database role permits — including `DROP TABLE users;` or `UPDATE accounts SET balance = 0 WHERE customer_id = 12345;`. PAM records that you did it. It does not stop you, did not analyze the statement, and cannot tell whether the change is safe.

→ Bytebase parses every statement against [200+ rules](https://docs.bytebase.com/sql-review/review-rules/) before it runs: require a `WHERE` clause on large-table updates, block `SELECT`s on sensitive columns without masking, restrict schema changes to maintenance hours.

### 2. Schema change workflow is missing entirely

Database changes have a specific lifecycle: write the migration, review the SQL, run on dev, run on staging, run on production, with rollback ready. PAM has no concept of this. Schema migrations either get pasted into a brokered session (reviewed nowhere), or they go through a separate CI/CD pipeline that bypasses PAM entirely (no joined audit trail).

→ Bytebase issues track schema changes like Jira tickets — target databases, SQL, rollout sequence, approval chain, rollback script. Documented in [Change Workflow](https://docs.bytebase.com/change-database/change-workflow/).

### 3. Approval is connection-level, not statement-level

A common PAM policy reads: "Engineer Alice has JIT read access to `prod_db` for 4 hours, approved by Bob." Inside that window, Alice can run `SELECT * FROM customers WHERE 1=1` because the approval covers the *connection*, not the *statements*. The audit log shows "Alice connected with read access" — exactly what was permitted.

→ Bytebase moves approval to the statement layer: a SELECT against a sensitive table can require a separate per-query approver; a DELETE on a large table can be blocked or escalated.

### 4. Session recording is not the same as a structured audit log

A 30-minute database session in PAM produces a 30-minute video. To answer "who deleted rows from `orders` last Tuesday?" a compliance team has to find every session that touched `orders` and watch each recording. This is not what auditors mean by "audit log."

→ Bytebase logs each executed statement as a searchable row: user, timestamp, database, statement text, row count, duration. SOC 2 and PCI auditors accept this format directly — the same compliance question becomes a single SQL query against the audit table instead of hours of video review. See [Database Audit Logging](/blog/database-audit-logging/) for the compliance-driven design.

### 5. No native database idioms

Power users don't want a session-recorded SSH wrapper that proxies to `psql`. They want `psql` itself — autocomplete, schema browser, query history, the `\d` shortcuts they actually know. PAM brokers the raw protocol but the surface developers see is a stripped-down terminal or a generic SQL pad. The friction pushes power users toward shadow tools — a `bastion` host with `psql` bypassing PAM "for productivity."

→ Bytebase's web SQL Editor speaks the native protocol, with autocomplete from the live schema, per-user query history, saved queries, and result export — without a session-recording overlay between the developer and the database.

## The hybrid pattern (recommended for most teams)

```mermaid
flowchart TB
    Dev(["Developer"])
    Dev --> SSH["SSH to server"]
    Dev --> Kube["kubectl exec"]
    Dev --> DBQ["Database query"]

    SSH --> PAM1["PAM gate"]
    Kube --> PAM2["PAM gate"]
    DBQ --> BB["Bytebase gate"]

    PAM1 --> Server["Linux server"]
    PAM2 --> Pod["K8s pod"]
    BB --> Workflow["SQL review<br/>Approval policy<br/>Execute on DB<br/>Searchable audit log"]

    style BB fill:#e0f2fe,stroke:#0369a1
    style Workflow fill:#e0f2fe,stroke:#0369a1
```

PAM owns infrastructure-wide access. Bytebase owns the database step. Both authenticate against the same identity provider, so policy decisions reference the same user. The audit trail in PAM shows "Alice connected to db.prod-1 at 14:32"; the audit trail in Bytebase shows "Alice ran `UPDATE accounts SET status='frozen' WHERE id IN (...)` at 14:34, approved by Bob, affected 47 rows." Together they answer the full question.

This is the right setup if PAM is already deployed, database access volume is meaningful, compliance scope (SOC 2, ISO 27001, HIPAA, PCI) covers the database, or schema changes happen more than once a month.

## When one is enough

**PAM alone is enough** if database access is rare (a few queries a week, mostly DBAs), the schema is stable, auditors accept session recordings as evidence, and the database surface is low-risk (read-only analytics, no PII). Most companies under 20 engineers fit this profile.

**Bytebase alone is enough** if the stack is database-only — no servers, no Kubernetes admin, no cloud consoles to gate. Common at companies on managed databases (Supabase, Neon, RDS-only, PlanetScale, Aurora-only) where there's no underlying server to SSH into. As the infrastructure footprint grows, PAM gets added back for the non-database surface.

## PAM vendor landscape

Each major vendor's database story in one line:

| PAM Tool | Strength | Database gap |
| --- | --- | --- |
| **CyberArk** | Most mature enterprise credential vault; broadest compliance certifications | No database workflow layer; pricing is enterprise-only |
| **BeyondTrust** | DevOps Secrets Safe for CI/CD secret injection | Same connection-level model — no SQL review, no schema workflow |
| **StrongDM** | Modern UX, JIT-first design, strong web SQL pad | Detailed comparison: [Bytebase vs. StrongDM](/blog/bytebase-vs-strongdm/) |
| **Teleport** | Open-source friendly, k8s and SSH-native | Database access is a feature; SQL review and approval policy are not |
| **HashiCorp Boundary** | Open-source PAM, Terraform-native | Newer to the database story; less feature depth |

The pattern across all five: each does PAM well in its niche, but none reads the SQL or runs database-specific approval logic. That's not a criticism — those are different products.

## Which should you choose?

The framing usually has the wrong shape:

- **You probably need PAM** if you have any infrastructure surface — servers, Kubernetes, cloud admin consoles
- **You probably need Bytebase** if databases are a meaningful part of the access surface and someone will ask "what SQL ran?" in an audit
- **You probably want both** if both are true. The cost of running both is lower than the cost of either gap

The replacement framing only works at the edges: a database-only startup uses Bytebase without PAM; a database-rare team uses PAM without Bytebase. Everyone in the middle uses both.

## FAQ

**Is Bytebase a PAM tool?**
No. Bytebase is a database DevSecOps platform — schema change workflow, SQL review, access control, and audit log for databases specifically. PAM covers infrastructure-wide access (servers, Kubernetes, cloud consoles). The two overlap at JIT database access, but the broader categories differ.

**Can PAM tools manage database access?**
Yes, at the connection level — PAM brokers the connection, vaults the credential, and records the session. PAM does not read the SQL, approve individual queries, run schema change workflow, or produce a searchable log of every query that ran.

**Do I need both PAM and Bytebase?**
Most enterprise teams do. PAM owns infrastructure access (SSH, kubectl, cloud admin). Bytebase owns the database step (SQL review, approval policy, audit log). Both authenticate against the same identity provider, so the user experience is one login. See [Database Access Control Best Practices](/blog/database-access-control-best-practices/) for the broader design.

**How does Bytebase compare to StrongDM for database access?**
StrongDM is a PAM tool with a strong database story; Bytebase is database-native. The two are usually deployed together rather than against each other. Full breakdown: [Bytebase vs. StrongDM](/blog/bytebase-vs-strongdm/).

**Can Bytebase replace CyberArk for database access?**
For database-only access — yes, Bytebase can be the sole control plane. For server, Kubernetes, and cloud admin access — no, those need PAM. CyberArk is rarely removed from an enterprise that already has it.

**What's the difference between database PAM and database DevSecOps?**
Both vault database credentials and gate who can connect. The difference is scope above and below: PAM also vaults SSH keys, cloud tokens, and web-app credentials across the entire infrastructure; database DevSecOps adds SQL review, change workflow, [data access governance](/blog/data-access-governance/), and statement-level audit on top of the database connection. Different layers, and most production deployments use both.

**Does PAM cover SQL injection or DML risk?**
No. PAM logs the session that contained the SQL, but does not analyze the SQL itself. Static and policy-based SQL review (Bytebase) operates at a different layer — it parses each statement before execution and applies rules.



> Atlas is Terraform for databases. Bytebase is GitHub/GitLab for databases.

Both Bytebase and Atlas handle database schema migration. Atlas is a migration engine — you declare the desired schema state and it generates the SQL to get there. Bytebase is an all-in-one database DevSecOps platform — it covers the full lifecycle from migration review and deployment to access control, data masking, and audit logging. If your team spends too much time writing migration files, Atlas eliminates that step. If you need to manage who can change what, enforce review before deployment, mask sensitive data in query results, and keep an audit trail of every database operation — that's the problem Bytebase solves.

## How They Approach Schema Migration

**Atlas** (v1.1, February 2026) takes a declarative approach inspired by Terraform. You define your desired database schema in HCL, SQL, or import it from an ORM (16 ORMs supported across Go, Python, Node.js, Ruby, PHP, and Java). Run `atlas schema apply` and Atlas computes the diff between the current database state and your desired state, then generates and executes the migration. No manually written migration files needed — though Atlas also supports a versioned workflow where you generate migration files for review with `atlas migrate diff`.

**Bytebase** (v3.16, March 2026) primarily takes a workflow approach. Developers write SQL migration statements (or use schema sync to auto-generate them), submit them as change issues through a web GUI, and the system routes them through review, approval, and rollout. Bytebase also supports a [declarative state-based workflow](https://docs.bytebase.com/gitops/state-based-workflow/overview) for PostgreSQL — you commit the desired schema state to Git, and Bytebase generates the migration SQL automatically, similar to Atlas's approach. State-based support for other databases is on the roadmap.

Where does your team actually lose time? If developers keep writing bad migration SQL — wrong column type, missing index, forgotten constraint — Atlas catches that by generating the SQL for you. If the SQL itself is fine but it ships to production without review, or the wrong person runs it against the wrong database — Bytebase is built to stop that.

## What They Have in Common

- Schema diffing and sync — both can compare two database states and generate migration SQL.
- GitOps integration — both support Git-driven workflows where committed schema files trigger migrations.
- SQL linting — Atlas has 50+ safety analyzers; Bytebase has 200+ SQL review rules.
- Multi-database support — Atlas supports 16 engines; Bytebase supports 25.
- Open source with commercial tiers — Atlas CLI is Apache 2.0; Bytebase is MIT + Enterprise License (enterprise features).

## Key Differences Between Bytebase and Atlas

|                                | Atlas | Bytebase |
| ------------------------------ | ----- | -------- |
| [Migration approach](#migration-approach) | Declarative (HCL / SQL / ORM) | Imperative (SQL) + [state-based for PostgreSQL](https://docs.bytebase.com/gitops/state-based-workflow/overview) |
| [Developer interface](#developer-interface) | CLI; Cloud adds web dashboard | Web GUI + API + Terraform provider |
| [Supported databases](#supported-databases) | 16 (Starter tier: limited) | 23 |
| [ORM integration](#orm-integration) | 16 ORMs across 6 languages | — |
| [Migration linting](#migration-linting) | 50+ analyzers (local free; CI on Cloud Pro) | 200+ rules (all tiers) |
| [Batch change](#batch-change) | Rollout strategies; Cloud Pro adds canary | Built-in multi-env / multi-tenant |
| [Approval flow](#approval-flow) | Cloud Pro: ad-hoc approval | All tiers: manual rollout; Enterprise: custom multi-tier approval |
| [CI/CD integration](#cicd-integration) | GitHub Actions, Terraform, K8s operator; Cloud Pro adds managed CI | GitOps (GitHub, GitLab, Bitbucket, Azure DevOps) + API for any platform |
| [Access control & audit](#access-control-and-audit) | Cloud Pro: audit trails; Enterprise: SSO | All tiers: workspace/project roles; Pro: SSO, audit log; Enterprise: + dynamic data masking, just-in-time data access, custom roles |
| License | CLI: Apache 2.0 | MIT + commercial (Enterprise features) |

### Pricing Comparison

|  | Free | Mid-tier | Enterprise |
| --- | --- | --- | --- |
| **Atlas** | CLI (Apache 2.0, self-hosted, no limits) + Cloud Starter (limited DB support) | Cloud Pro: $9/dev/mo + $59/project/mo + $39/DB/mo | Custom (20+ DBs, SSO, air-gapped) |
| **Bytebase** | Community (self-hosted, up to 20 users, 10 instances) | Pro: $20/user/mo (cloud-only, up to 10 instances) | Custom yearly (self-hosted or cloud) |

### Migration Approach

**Atlas** uses a declarative model — you describe what you want the schema to look like, and Atlas plans how to get there. If you add a column to your HCL schema file, Atlas detects the difference and generates `ALTER TABLE ... ADD COLUMN` automatically. You never write migration SQL by hand unless you want to.

Atlas schemas can be defined in HCL:

```hcl
table "users" {
  schema = schema.public
  column "id" {
    type = int
  }
  column "name" {
    type = varchar(100)
  }
  primary_key {
    columns = [column.id]
  }
}
```

Or imported directly from your ORM — Atlas supports GORM, Ent, Django, SQLAlchemy, TypeORM, Sequelize, and 10 others. This means your application code is the source of truth for your schema, and Atlas generates migrations from it.

**Bytebase** primarily uses an imperative model — developers write the migration SQL themselves, submit it as an issue, get it reviewed, and deploy it. But Bytebase also supports a [state-based workflow](https://docs.bytebase.com/gitops/state-based-workflow/overview) for PostgreSQL: you commit the desired schema state to Git, and Bytebase generates the migration SQL automatically. It's the same idea as Atlas's declarative approach, though currently limited to Postgres. For other databases, Bytebase's schema sync can auto-generate diff SQL between two database states.

If your ORM already produces the SQL you need, Atlas's declarative approach is redundant — but Bytebase's review pipeline still applies. If you're a two-person team deploying your own changes, Bytebase's approval flow is overhead you don't need — but Atlas's auto-generated migrations save real time.

### Developer Interface

**Atlas** is CLI-first. You run `atlas schema inspect`, `atlas migrate diff`, `atlas schema apply` from the terminal. Atlas Cloud (paid) adds a web dashboard for monitoring deployments, viewing schema history, and running CI checks — but the core workflow stays in the CLI.

**Bytebase** is GUI-first. Developers create issues, DBAs review them, and the platform handles rollout — all through a web interface. It also exposes an [API](https://api.bytebase.com/), a [Terraform provider](https://docs.bytebase.com/integrations/terraform/overview), and [GitOps workflow tutorials](https://docs.bytebase.com/tutorials/gitops-github-workflow) for teams that prefer automation over clicking.

A team of developers who live in the terminal and deploy their own changes will find Atlas's CLI workflow faster. Once changes start passing through multiple hands — developer writes, lead reviews, DBA approves — you need that handoff to be visible and traceable, which is what Bytebase's GUI provides.

### Supported Databases

**Atlas** supports 16 databases: PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, ClickHouse, CockroachDB, TiDB, Oracle, Snowflake, Databricks, Spanner, Redshift, Aurora DSQL, and Azure Fabric. CockroachDB is supported both self-hosted and via CockroachDB Cloud. Several graduated from beta to GA in the v1.0 release (December 2025).

**Bytebase** supports 25 engines: 9 RDBMS (MySQL, PostgreSQL, Oracle, SQL Server, MariaDB, TiDB, OceanBase, CockroachDB, Spanner), 6 NoSQL (MongoDB, Redis, Cassandra, DocumentDB, DynamoDB, Cosmos DB), 9 data warehouses (Snowflake, BigQuery, Redshift, Hive, ClickHouse, Databricks, StarRocks, Doris, Trino), and Elasticsearch.

Atlas's declarative model handles 98%+ of each engine's DDL features — it goes deep on schema management. Bytebase covers more engine types (NoSQL, data warehouses) and adds features beyond migration: data masking, query control, access governance per engine.

### ORM Integration

Atlas integrates with 16 ORMs across 6 languages — GORM, Ent, Django, SQLAlchemy, Sequelize, TypeORM, Prisma, and others. It reads your ORM models directly and generates migrations without an intermediate schema file.

**Bytebase** doesn't integrate with ORMs for schema definition. It expects SQL input, whether hand-written or generated by your ORM's migration commands. If your team already uses Django's `makemigrations` or Rails' `db:migrate`, Bytebase fits into the pipeline after those tools generate SQL.

### Migration Linting

**Atlas** includes 50+ safety analyzers that catch destructive changes (dropping columns, tables), backward-incompatible modifications, data-dependent changes that might fail on large tables, and potential table locks. The open-source CLI runs these locally via `atlas migrate lint` for free. Atlas Cloud Pro adds managed CI integration — running lint checks automatically in GitHub Actions PRs.

**Bytebase** has 200+ [SQL review rules](https://docs.bytebase.com/sql-review/review-rules) that are database-engine-specific. Rules cover naming conventions, query patterns, schema design, and safety checks. You configure different error levels per environment — warn in dev, block in prod. Available in the free tier.

Atlas focuses on safety: will this migration break things? Destructive changes, lock risks, data-dependent failures. Bytebase checks safety too, but layers on team conventions — naming rules, query patterns, engine-specific best practices. You can fail a migration in Bytebase because a column name uses camelCase instead of snake_case.

### Batch Change

**Atlas** added deployment rollout strategies in v1.0 (December 2025). You can define staged rollouts with canary databases, parallelism limits, and error handling — useful for multi-tenant deployments where the same migration hits hundreds of databases.

**Bytebase** has had multi-environment and [multi-tenant batch changes](https://docs.bytebase.com/change-database/batch-change) since earlier versions. A single issue can deploy across dev, staging, and prod with gates between stages, or across hundreds of tenant databases with canary support.

Both handle fleet deployments. Atlas leans on code-defined rollout strategy — set it and let it run. Bytebase gives you a GUI where you watch it roll out in real time and can pause mid-deployment if something looks off.

### Approval Flow

**Atlas** open source has no approval workflow. **Atlas Cloud** supports ad-hoc approval workflows for declarative schema changes — someone can review and approve a migration plan before it's applied.

**Bytebase** Community and Pro include manual rollout — someone clicks "Deploy" to apply a change, which already prevents accidental or unauthorized execution. **Bytebase Enterprise** adds [custom approval flows](https://docs.bytebase.com/change-database/approval) on top: define rules like "DDL on prod needs DBA approval" or "changes touching 3+ databases need manager sign-off," and changes route through multi-tier approval automatically.

If the developer who writes the migration also applies it, you don't need an approval workflow — Atlas is fine. Once production changes require sign-off from someone other than the author, you need a system that enforces it, not a Slack message asking "can I deploy this?"

### CI/CD Integration

**Atlas** has native integrations with GitHub Actions, Terraform, Kubernetes (via an operator), GitLab CI, CircleCI, Azure DevOps, and ArgoCD. The GitHub Actions integration (`ariga/atlas-action`) is particularly mature — it lints migrations in PRs, applies them on merge, and supports approval workflows.

**Bytebase** offers [GitOps setup](https://docs.bytebase.com/gitops/overview) with GitHub, GitLab, Bitbucket, and Azure DevOps. SQL files committed to a repo create change issues in Bytebase automatically, with SQL review running as a merge check. For platforms without built-in integration, Bytebase's [API](https://api.bytebase.com/) lets you wire up any CI/CD pipeline — Jenkins, CircleCI, or your own scripts.

If your infrastructure is already Terraform-managed and your apps run on Kubernetes, Atlas slots right in — same declarative model, same toolchain. Bytebase takes a different angle: one place to see every database change across every environment, whether it's pending, in review, deploying, or done.

### Access Control and Audit

**Atlas** open source doesn't touch access control. **Atlas Cloud** adds audit trails and schema governance — you can see who applied what migration and when, but there's no role system or data masking.

**Bytebase** layers access control across its tiers:

- **Community** — [workspace and project roles](https://docs.bytebase.com/administration/roles) (Owner, DBA, Developer) with built-in permissions.
- **Pro** — adds SSO, [audit log](https://docs.bytebase.com/security/audit-log), and user groups.
- **Enterprise** — the full governance stack: [custom roles](https://docs.bytebase.com/administration/roles) with granular permissions, [dynamic data masking](https://docs.bytebase.com/security/data-masking/overview) at column level, Just-In-Time data access, enterprise SSO (OIDC, LDAP), and 2FA.

When your SOC 2 auditor asks "who approved this production change and when," Bytebase has the answer without stitching together logs from three different tools. Atlas Cloud records who ran the migration, but the approval chain, access control, and data masking live elsewhere in your stack.

### Pricing

**Atlas** has two tracks. The open-source CLI is Apache 2.0 — declarative migrations, versioned migrations, local linting, ORM integration, all free with no limits. Atlas Cloud adds CI/CD automation, drift detection, schema governance, and audit trails in three tiers: Starter (free, limited database support and inspection), Pro ($9/dev/month + $59/project/month + $39/month per additional database), and Enterprise (custom, 20+ databases, SSO, air-gapped deployment). The Pro costs add up — 5 developers with 1 CI project is $104/month before extra databases.

**Bytebase** has three tiers with different deployment models. Community is free, self-hosted, supports up to 20 users and 10 database instances — includes the full GUI, SQL review (200+ rules), GitOps, and multi-environment rollouts. Pro is $20/user/month, cloud-only, up to 10 database instances, and adds SSO, audit log, and user groups. Enterprise is custom pricing (yearly), available self-hosted or cloud, and adds custom approval workflows, dynamic data masking, OIDC/LDAP SSO, custom roles, audit logging, SCIM, and 2FA. [Full pricing details](https://www.bytebase.com/pricing/).

The pricing models reflect different philosophies. Atlas charges per developer, per project, and per database — costs scale with infrastructure complexity. Bytebase charges per user — costs scale with team size. A 5-person team managing 1 project with 3 databases pays Atlas $221/month; the same team on Bytebase Pro pays $100/month flat.

## When to Choose Atlas

- Your team writes schema definitions in code (HCL or ORM models) and wants automatic migration generation.
- You prefer managing database schemas with the same declarative, infrastructure-as-code pattern you use for application deployments.
- Your workflow is developer-driven — whoever writes the code also manages the database, without a separate DBA review step.
- You want the Apache 2.0 CLI without vendor lock-in for the core migration engine.

## When to Choose Bytebase

- You want an all-in-one platform that covers migration, SQL review, access control, data masking, and audit logging — not just migration execution.
- Your team has a separation between developers who write changes and DBAs/platform engineers who review and deploy them.
- You need compliance — approval flows, audit trails, and data masking for SOC 2, GDPR, or internal security policies.
- You want a single web interface where all database changes are visible, reviewable, and traceable across environments.

## FAQ

### Can I use Atlas and Bytebase together?

Yes. Use Atlas to generate migration SQL from your HCL or ORM models, then submit that SQL through Bytebase for review and controlled rollout. Atlas handles "what changes"; Bytebase handles "who approves and how it ships." Some teams actually run both — Atlas for the migration engine, Bytebase for the governance layer.

### Atlas is declarative — does that mean it's always better than writing SQL?

For adding tables and columns, yes — you describe the end state and Atlas figures out the ALTER statements. Bytebase offers the same declarative approach for PostgreSQL via its [state-based workflow](https://docs.bytebase.com/gitops/state-based-workflow/overview), though Atlas supports it across all 16 of its database engines. Declarative breaks down with data migrations: moving data between columns, backfilling defaults, splitting tables. That requires imperative SQL that understands the data, not just the schema shape. Even Atlas-heavy teams write hand-crafted migrations for those.

### Which tool has better CI/CD integration?

Depends on your stack. Atlas has a Kubernetes operator and Terraform provider, so if you're already managing infrastructure declaratively, database schemas fit the same pipeline. Bytebase has tighter GitHub/GitLab integration — commit a SQL file and it becomes a reviewable change issue with linting results inline. Pick whichever matches how your team already ships.

### Is Bytebase Community actually usable for production?

Yes. Community includes the full web GUI, 200+ SQL review rules, GitOps integration, multi-environment rollouts, and batch changes — the same core workflow as paid tiers, not a stripped-down demo. The limits are 20 users and 10 database instances. What you don't get is SSO, audit log (Pro), or custom approval flows, data masking, and custom roles (Enterprise). Plenty of teams run Community in production and only upgrade when they need compliance features.

### Is Atlas really free?

The CLI is fully free under Apache 2.0 — declarative migrations, versioned migrations, local linting, ORM integration, no limits. Atlas Cloud is a separate product: Starter (free, limited database support), Pro ($9/dev/month + $59/project/month + $39/DB/month for CI/CD, drift detection, governance), and Enterprise (custom pricing, SSO, air-gapped deployment). The CLI alone covers most solo/small-team needs; you hit Cloud when you want managed CI runs or monitoring.

---

Related comparisons:

- [Bytebase vs. Liquibase](/blog/bytebase-vs-liquibase/)
- [Bytebase vs. Flyway](/blog/bytebase-vs-flyway/)
- [Flyway vs. Liquibase](/blog/flyway-vs-liquibase/)
- [Top Database Schema Change Tools](/blog/top-database-schema-change-tool-evolution/)
- [Database Version Control](/blog/database-version-control/)



Database access control is the set of policies and mechanisms that determine who can connect to a database, what operations they can perform, and how long that access lasts. It covers both authentication (proving identity) and authorization (granting permissions) at the database engine level, independently of application-layer controls.

Get it wrong and you are one `DROP TABLE` away from a production incident, or one leaked credential away from a compliance violation. Most teams start with a shared admin account and a handful of application credentials. That works until the first [SOC 2 audit](/blog/soc2-data-security-and-retention-requirements/) asks *"who ran this query on March 3rd?"* and nobody can answer. This guide covers the principles, engine-specific mechanics, and common mistakes of database access control, along with practical ways to fix them.

## What a working access control system looks like

Even if your app restricts what users see in the UI, anyone with direct database credentials can bypass those restrictions entirely. A working access control system answers four questions:

1. **Who** is connecting? (A named individual, not a shared account.)
2. **What** can they do? (Read, write, alter schema, grant permissions to others.)
3. **Where** can they do it? (Which databases, schemas, tables, columns.)
4. **How long** does the access last? (Permanent, time-boxed, or on-demand.)

## Why access control matters for compliance

Every major compliance framework requires database-level access controls. The specific requirements overlap more than they differ:

| Framework | Access control requirement | Audit trail required? |
|-----------|---------------------------|----------------------|
| SOC 2 (CC6.1, CC6.3) | Least privilege, regular access reviews | Yes |
| [HIPAA](/blog/hipaa-data-security-and-retention-requirements/) (§164.312) | Unique user IDs, emergency access procedures | Yes |
| [GDPR](/blog/database-compliance-for-gdpr/) | Access limited to purpose of processing | Yes |
| PCI DSS (Req 7, 8) | Role-based access, no shared accounts | Yes |
| [SOX](/blog/database-change-management-sox-compliance/) | Separation of duties, change audit trails | Yes |
| ISO 27001 (A.9) | Formal access provisioning and de-provisioning | Yes |

The pattern is clear: restrict access to the minimum necessary, track every action, and review permissions regularly. Failing an audit because of overly broad database permissions is one of the most common compliance findings.

## Core principles

### Least privilege

Every user and application should have the minimum permissions required to do their job. A developer who needs to run `SELECT` queries against a staging database does not need `DROP` or `ALTER` privileges on production.

In practice, least privilege means:

- Application accounts get only `SELECT`, `INSERT`, `UPDATE`, `DELETE` on the tables they use
- Schema migration accounts are separate from application accounts
- Read-only replicas use credentials that cannot write
- Admin access is reserved for DBAs and granted per-session, not permanently

### Separation of duties

The person who writes a database change should not be the same person who approves and deploys it. This prevents both accidental mistakes and intentional abuse.

A typical separation looks like:

- **Developer** writes the migration SQL
- **DBA or tech lead** reviews the SQL for correctness and safety
- **Automated pipeline or separate role** executes the approved change
- **[Audit log](/blog/database-audit-logging/)** records who did what at each step

### Just-in-time access

Permanent standing access is the default in most organizations, and it is the wrong default. A developer who accessed the production database for a debugging session six months ago probably still has those credentials. If those credentials leak, the blast radius is the entire production dataset.

Just-in-time (JIT) access replaces permanent credentials with temporary, scoped grants:

1. User requests access to a specific database for a stated reason
2. An approver reviews and approves the request
3. The system grants access with a time limit (e.g., 2 hours)
4. Access is automatically revoked when the window closes

JIT access reduces standing privileges to near zero. Auditors prefer it because every access event has a documented reason and approval chain.

### Role-based access control (RBAC)

Managing permissions per user does not scale. RBAC groups permissions into roles and assigns roles to users. When someone joins a team, they inherit the team's role. When they leave, revoking the role removes all associated permissions in one step.

Common database roles:

| Role | Typical permissions |
|------|-------------------|
| `app_readonly` | `SELECT` on application tables |
| `app_readwrite` | `SELECT`, `INSERT`, `UPDATE`, `DELETE` on application tables |
| `schema_migrator` | `CREATE`, `ALTER`, `DROP` on schema objects |
| `dba_admin` | Full privileges, granted via JIT only |
| `analyst` | `SELECT` on reporting views and materialized views |

## How each database engine handles access control

Every major database has RBAC built in, but the syntax and defaults vary.

### PostgreSQL

PostgreSQL uses **roles** as both users and groups. A role can own objects, log in, and be a member of other roles.

```sql
-- Create a read-only role
CREATE ROLE app_readonly NOLOGIN;
GRANT CONNECT ON DATABASE myapp TO app_readonly;
GRANT USAGE ON SCHEMA public TO app_readonly;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO app_readonly;
-- Ensure future tables created by the migration role are also readable
ALTER DEFAULT PRIVILEGES FOR ROLE migrator IN SCHEMA public
  GRANT SELECT ON TABLES TO app_readonly;

-- Create a user that inherits the role
CREATE ROLE analyst LOGIN PASSWORD 'strong_password';
GRANT app_readonly TO analyst;
```

PostgreSQL's default is deny-all: a new role has no permissions on objects it does not own. The `ALTER DEFAULT PRIVILEGES` command is easy to forget but is needed to cover tables created in the future. Note that it only applies to objects created by the role that executes the statement. If a separate role (e.g., a migration role) creates tables, you must specify `FOR ROLE <owner>` or run the command as that role.

### MySQL

MySQL separates users (`CREATE USER`) from privileges (`GRANT`). There is no built-in role grouping in MySQL 5.7, but MySQL 8.0+ supports roles.

```sql
-- MySQL 8.0+ roles
CREATE ROLE 'app_readonly';
GRANT SELECT ON myapp.* TO 'app_readonly';

CREATE USER 'analyst'@'10.0.%' IDENTIFIED BY 'strong_password';
GRANT 'app_readonly' TO 'analyst'@'10.0.%';
SET DEFAULT ROLE 'app_readonly' TO 'analyst'@'10.0.%';
```

MySQL ties users to hostnames (`'user'@'host'`), which means the same person connecting from different networks can have different permissions. This is both a security feature and a source of confusion.

### SQL Server

SQL Server uses **logins** (server-level) and **users** (database-level), mapped together. It has built-in fixed server roles (`sysadmin`, `securityadmin`) and database roles (`db_datareader`, `db_datawriter`), plus support for custom roles.

```sql
-- Create a database role with read-only access
CREATE ROLE app_readonly;
GRANT SELECT ON SCHEMA::dbo TO app_readonly;

-- Create a login and map it to a database user
CREATE LOGIN analyst WITH PASSWORD = 'strong_password';
CREATE USER analyst FOR LOGIN analyst;
ALTER ROLE app_readonly ADD MEMBER analyst;
```

SQL Server's `DENY` takes precedence over `GRANT`, which allows for precise permission exclusions.

### Oracle

Oracle uses **profiles** and **roles** with fine-grained privileges. Oracle supports row-level security (Virtual Private Database) and data redaction natively.

```sql
-- Create a role
CREATE ROLE app_readonly;
GRANT SELECT ON schema.orders TO app_readonly;
GRANT SELECT ON schema.customers TO app_readonly;

-- Assign to a user
GRANT app_readonly TO analyst;
```

Oracle's `GRANT` syntax is similar to PostgreSQL, but Oracle also supports `GRANT ANY` privileges that operate across all schemas. These `ANY` privileges are powerful and should be avoided for non-DBA accounts.

## Common mistakes

**1. Shared service accounts.** Multiple developers sharing `admin@production` makes every query untraceable. When an auditor asks who ran a destructive query, the answer is "anyone on the team." Use individual accounts and map every connection to a real person.

**2. Copy-pasting permissions from another user.** When a new hire joins, the fastest path is to clone an existing user's grants. The problem is that the existing user has accumulated permissions over months. The new hire inherits permissions they do not need and the privilege creep compounds.

**3. Never revoking access.** People change teams, leave the company, or stop using certain databases. Without a regular access review cycle (monthly or quarterly), stale accounts accumulate. Automate de-provisioning through your identity provider where possible.

**4. Granting `ALL PRIVILEGES` because it is faster.** `GRANT ALL PRIVILEGES ON *.* TO 'app'@'%'` takes five seconds to type and months to clean up. Start with the minimum and add permissions as specific needs arise.

**5. No separation between application and human access.** Application service accounts and human developer accounts should be different. Applications need predictable, narrow permissions. Humans need broader permissions but only temporarily and with an audit trail.

**6. Ignoring schema-level isolation.** Databases that support schemas (PostgreSQL, SQL Server) give you a natural boundary for access control. Instead of granting access to individual tables, grant at the schema level and organize tables by access pattern.

## How Bytebase handles database access control

[Bytebase](https://www.bytebase.com) centralizes database access control across PostgreSQL, MySQL, SQL Server, Oracle, and other engines in a single interface. Instead of managing `GRANT` and `REVOKE` statements across multiple database clusters individually, teams manage permissions through Bytebase's two-level IAM system.

Key capabilities:

- **Two-level RBAC.** Bytebase has workspace-level roles (Admin, DBA, Member) and project-level roles (Owner, Developer, Releaser, SQL Editor User, Viewer). Each role maps to 100+ granular permissions. Organizations can also create custom roles with specific permission sets.
- **Conditional access with CEL expressions.** IAM bindings support [CEL](https://github.com/google/cel-spec) conditions, so you can scope access by database name, schema, or time window. For example, a binding can grant a developer query access to specific databases that expires on a set date.
- **Grant requests with expiration.** When a developer needs temporary access, they submit a grant request specifying the database, the role, and a duration. Once approved, the access expires automatically. This is the closest equivalent to just-in-time access.
- **Approval workflows.** Schema changes and data exports go through configurable approval chains with CEL-based matching rules. Approvers are resolved by role, so the request is automatically routed to the right DBA or project owner.
- **Dynamic data masking.** Masking rules use CEL conditions to match columns by environment, project, instance, database, table, column, or classification level. Masking exemption policies let specific users or groups bypass masking when needed, also with CEL conditions (including time-based expiration).
- **Query data policies.** Workspace and project-level policies control SQL Editor behavior: maximum result rows, whether data export is allowed, and whether copy-paste is enabled.
- **Audit logging.** Every query, schema change, and permission change is recorded with the real user identity, request metadata, and RPC latency. Logs are searchable with CEL filters and exportable. This [audit trail](/blog/database-audit-logging/) is what auditors need for SOC 2, HIPAA, and ISO 27001.
- **Groups and service accounts.** Users can be organized into groups and assigned roles as a group. Service accounts and workload identities (for CI/CD pipelines using OIDC) are first-class citizens in IAM bindings.

## FAQ

### What is the difference between authentication and authorization in databases?

Authentication verifies identity (who are you?). Authorization determines permissions (what can you do?). A database user must pass authentication first (usually with a password, certificate, or SSO token), then the database checks their authorization (granted roles and privileges) before allowing any operation.

### How often should database access be reviewed?

Quarterly reviews are the minimum for compliance. Monthly reviews are better for organizations with frequent team changes. Automated tools that flag unused accounts or permissions that haven't been exercised in 90 days reduce the manual work.

### Is row-level security considered access control?

Yes. Row-level security (RLS) restricts which rows a user can see within a table. PostgreSQL, SQL Server, and Oracle all support RLS natively. It is a form of authorization that operates at a finer grain than table-level `GRANT` and `REVOKE`.

### How does just-in-time access differ from VPN-based access control?

VPN controls which network can reach the database. JIT controls which person can access the database and for how long. They operate at different layers: a VPN alone does not satisfy least privilege because everyone on the VPN has the same network access. JIT adds identity-based, time-limited, and auditable access on top of network controls.



TRUNCATE and DELETE both remove rows from a table, but they work nothing alike under the hood. TRUNCATE drops all rows at once by deallocating the data pages. DELETE removes rows one at a time and logs each removal individually. This difference makes TRUNCATE faster on large tables, but it also means they behave differently with transactions, triggers, and foreign keys.

The bigger surprise: TRUNCATE is not even the same operation across databases. PostgreSQL treats it as a transactional command you can roll back. MySQL treats it as a DDL statement that commits immediately and cannot be undone. If you switch databases without knowing this, you will lose data.

## TRUNCATE vs DELETE at a glance

| | TRUNCATE | DELETE |
|---|---|---|
| Operation type | [DDL](/blog/what-is-ddl-and-dml-in-sql-database/) | [DML](/blog/what-is-ddl-and-dml-in-sql-database/) |
| Removes | All rows (no WHERE clause) | Selected rows (WHERE clause supported) |
| Speed on large tables | Fast (deallocates pages) | Slow (row-by-row logging) |
| Fires row-level triggers | No | Yes |
| Resets auto-increment / identity | Yes | No |
| Returns row count | No | Yes |
| Can be rolled back in PostgreSQL | Yes | Yes |
| Can be rolled back in MySQL | No (implicit commit) | Yes |
| Can be rolled back in SQL Server | Yes (within a transaction) | Yes |

The speed difference is not marginal. DELETE on a 47-million-row table scans every row and writes a WAL entry for each one. That can take hours. TRUNCATE on the same table finishes in under a second because it discards the data files without touching individual rows.

## TRUNCATE in PostgreSQL

PostgreSQL is the most flexible of the three. It wraps TRUNCATE inside transactions, just like any other command, so you can truncate a table and roll it back if something goes wrong.

```sql
BEGIN;
TRUNCATE employees;
-- Changed your mind?
ROLLBACK;
-- All rows are still there.
```

You also get control over auto-increment sequences:

```sql
-- Reset the sequence back to 1
TRUNCATE orders RESTART IDENTITY;

-- Keep the current sequence value
TRUNCATE orders CONTINUE IDENTITY;
```

Both the row removal and the sequence reset are transactional. Roll back, and the sequence returns to its previous value too. This is unusual. Even PostgreSQL's own `ALTER SEQUENCE RESTART` is not transactional outside of a TRUNCATE context.

For tables with foreign key references, PostgreSQL blocks TRUNCATE unless you add `CASCADE`:

```sql
-- This fails if other tables reference "orders"
TRUNCATE orders;

-- This truncates "orders" and any tables that reference it
TRUNCATE orders CASCADE;
```

Be careful with CASCADE. It silently empties every table linked by a foreign key chain, and on a schema with 30+ tables, that chain can reach tables you forgot were connected.

## TRUNCATE in MySQL

Different story. MySQL's TRUNCATE is a DDL statement that [causes an implicit commit](https://dev.mysql.com/doc/refman/8.0/en/implicit-commit.html), so it cannot be rolled back.

```sql
START TRANSACTION;
TRUNCATE employees;
-- The TRUNCATE already committed. ROLLBACK does nothing here.
ROLLBACK;
-- The table is empty.
```

This catches people who move from PostgreSQL to MySQL. They write TRUNCATE inside a transaction block expecting safety, and the data is gone the moment the statement runs. No warning, no error. The ROLLBACK succeeds silently and does nothing.

MySQL always resets AUTO_INCREMENT to 1 on TRUNCATE. No option to keep the current value, unlike PostgreSQL's `CONTINUE IDENTITY`.

Foreign keys are also handled differently. MySQL blocks TRUNCATE if the table is referenced by a foreign key from another table, even if the referencing table has zero rows. The workaround:

```sql
SET FOREIGN_KEY_CHECKS = 0;
TRUNCATE orders;
SET FOREIGN_KEY_CHECKS = 1;
```

Disabling foreign key checks is a blunt tool. If another session inserts rows referencing the truncated table while checks are off, you get orphaned records with no constraint violation. MySQL will not tell you about them.

## TRUNCATE in SQL Server

SQL Server sits between the two. It allows TRUNCATE inside explicit transactions (like PostgreSQL) but lacks the sequence control options.

```sql
BEGIN TRANSACTION;
TRUNCATE TABLE employees;
-- Safe to roll back
ROLLBACK;
```

The IDENTITY seed always resets. No equivalent to PostgreSQL's `CONTINUE IDENTITY`.

SQL Server is the strictest about foreign keys. It blocks TRUNCATE on any table referenced by a FOREIGN KEY constraint, even if `ON DELETE CASCADE` is defined. No CASCADE option for TRUNCATE, no `FOREIGN_KEY_CHECKS` toggle. Your only choices are DELETE or dropping the constraint entirely.

One edge case worth knowing: TRUNCATE also fails on tables that participate in indexed views or are published through transactional replication.

## When to use TRUNCATE vs DELETE

Use TRUNCATE for bulk cleanup: emptying staging tables between ETL loads, wiping test data, resetting a table after a failed migration. If the table has 10 million rows and you need all of them gone, TRUNCATE is the only practical option.

Use DELETE for everything else. You need a WHERE clause, you need triggers to fire, you need to know exactly how many rows were removed. DELETE is slower but it plays by the rules.

One recommendation: if you are writing application code that removes rows, always use DELETE. TRUNCATE belongs in migration scripts, maintenance jobs, and CI pipelines. Putting TRUNCATE in application logic is asking for trouble when someone adds a foreign key to that table six months later.

## TRUNCATE and foreign keys

All three databases block TRUNCATE when another table holds a foreign key reference. The workarounds differ, and none of them are safe to run blindly.

| Database | Workaround |
|---|---|
| PostgreSQL | `TRUNCATE table CASCADE` (truncates referencing tables too) |
| MySQL | `SET FOREIGN_KEY_CHECKS = 0` before TRUNCATE, re-enable after |
| SQL Server | Drop the foreign key constraint, TRUNCATE, recreate the constraint |

CASCADE can wipe tables you did not intend. Disabling foreign key checks opens a window for orphaned rows. Dropping and recreating constraints on a large schema is slow and error-prone.

If the table has foreign key dependencies, just use DELETE. Slower, but it respects constraints without workarounds and without the risk of silently destroying related data.

## How Bytebase prevents accidental TRUNCATE

Running TRUNCATE on a production table by accident takes seconds. Recovering from it takes hours if you have backups, and is impossible if you don't.

[Bytebase](/) provides [SQL review rules](https://www.bytebase.com/docs/sql-review/review-rules/) that flag or block TRUNCATE statements before they reach production. You can set policies like prohibiting TRUNCATE on production environments, requiring approval for DDL statements, or flagging CASCADE operations that touch multiple tables.

These rules run automatically when a developer submits a SQL change through Bytebase, catching dangerous statements during review rather than after execution. See [The SQL Review Tool for Developers](/blog/sql-review-tool-for-devs/) for how this fits into a team workflow.

## FAQ

**Is TRUNCATE faster than DELETE?**

Yes. TRUNCATE deallocates data pages without scanning or logging individual rows. On tables with millions of rows, TRUNCATE completes in under a second while DELETE can take minutes or hours.

**Does TRUNCATE reset AUTO_INCREMENT?**

Yes in all three databases. PostgreSQL gives you a choice with `RESTART IDENTITY` (reset) or `CONTINUE IDENTITY` (keep current value). MySQL and SQL Server always reset to the starting value.

**Can I TRUNCATE a table with foreign keys?**

Not directly. All three databases block TRUNCATE when another table references the target with a foreign key. PostgreSQL supports `CASCADE` to truncate referencing tables. MySQL requires disabling `FOREIGN_KEY_CHECKS`. SQL Server requires dropping the constraint first.

**Is TRUNCATE a DDL or DML statement?**

TRUNCATE is classified as [DDL (Data Definition Language)](/blog/what-is-ddl-and-dml-in-sql-database/). DELETE is DML. This classification explains why MySQL's TRUNCATE triggers an implicit commit: MySQL auto-commits all DDL statements. PostgreSQL and SQL Server handle it differently by allowing DDL inside transactions. For more on how [PostgreSQL and MySQL handle DDL transactions differently](/blog/postgres-vs-mysql-ddl-transaction/), see our detailed comparison.



Database design patterns are reusable structural approaches to organizing tables, relationships, and indexes in a relational database. Picking the wrong pattern early on is expensive. The pattern you choose defines your query performance ceiling, your data integrity guarantees, and how painful your next schema migration will be.

This guide covers six patterns that show up in most production systems, the trade-offs behind each, and the anti-patterns that cause real-world outages.

## What are database design patterns?

A database design pattern is a repeatable solution to a common data modeling problem. It is a structural decision about how tables relate to each other, how data is split or combined, and where you put the boundaries between entities. Some patterns optimize for write safety (normalization), others for read speed (star schema), others for flexibility (EAV, JSONB columns), and others for organizational isolation (multi-tenancy). Most production databases use several patterns together.

## Normalization (1NF through 3NF)

Normalization removes redundant data by splitting it across related tables. The goal is to make sure each fact is stored exactly once, so updates only happen in one place.

**First Normal Form (1NF):** Every column holds a single value. No comma-separated lists, no arrays stuffed into a VARCHAR. Each row is uniquely identifiable by a [primary key](/blog/primary-key-vs-foreign-key/).

**Second Normal Form (2NF):** Every non-key column depends on the entire primary key, not just part of it. This matters when you have composite keys. If an `order_items` table is keyed on `(order_id, product_id)`, the `product_name` depends only on `product_id` and should live in a separate `products` table.

**Third Normal Form (3NF):** Non-key columns depend only on the primary key, not on other non-key columns. If a `customers` table has `city` and `state`, and `city` determines `state`, then `state` should move to a `cities` table. This eliminates transitive dependencies.

### When to denormalize

3NF is the default target for transactional systems. But read-heavy workloads (dashboards, reports, search) often need denormalized data to avoid expensive multi-table joins. Denormalization means deliberately adding redundancy, like storing `total_orders_count` directly on a customer row instead of computing `COUNT(*)` from the orders table on every request.

The rule: start normalized, denormalize when you have measured evidence that a specific query is too slow.

## Star schema and snowflake schema

These patterns are for analytical workloads, not transactional ones.

**Star schema** puts a central fact table (containing measures like revenue, quantity, or duration) surrounded by denormalized dimension tables (date, product, customer, region). Each query is one join from fact to dimension. It is simple and fast.

**Snowflake schema** normalizes the dimension tables into sub-dimensions. A `location` dimension splits into `city → state → country` tables. This saves storage and improves data integrity at the cost of more joins.

| | Star schema | Snowflake schema |
|---|:-:|:-:|
| **Dimension tables** | Denormalized | Normalized into sub-tables |
| **Query joins** | Fewer | More |
| **Storage** | Higher (redundant data) | Lower |
| **Query speed** | Faster | Slower |
| **Best for** | Dashboards, ad-hoc BI | Complex hierarchies, storage-sensitive environments |

Modern columnar warehouses (Snowflake, BigQuery, Redshift) have optimized away much of the performance penalty of snowflake schemas, so the choice is less about speed and more about how your team thinks about the data. Star schema remains the default for most [analytics use cases](/blog/top-database-schema-diagram-tools/) because it is easier to understand and query.

## Entity-Attribute-Value (EAV)

EAV stores data in three columns: `entity_id`, `attribute_name`, and `value`. Instead of a wide table with one column per attribute, each attribute becomes a row.

```sql
-- EAV table
CREATE TABLE product_attributes (
    entity_id   INT REFERENCES products(id),
    attribute   VARCHAR(100),
    value       VARCHAR(255)
);

-- A T-shirt has size and color; a laptop has cpu and ram_gb.
-- Both go in the same table.
INSERT INTO product_attributes VALUES (1, 'size', 'XL');
INSERT INTO product_attributes VALUES (1, 'color', 'blue');
INSERT INTO product_attributes VALUES (2, 'cpu', 'M3 Pro');
INSERT INTO product_attributes VALUES (2, 'ram_gb', '36');
```

**When it looks attractive:** Product catalogs with hundreds of optional attributes. Clinical records with thousands of possible fields per patient.

**Why it usually fails:** Every query that retrieves multiple attributes requires self-joins or pivot operations. Filtering is slow because `value` is always VARCHAR (no type checking, no numeric indexing). Magento 1.x used EAV for product data and was notorious for poor query performance at scale. PostgreSQL benchmarks show that JSONB is over 50,000x faster than EAV for unindexed queries, while producing a database 3x smaller.

**The modern alternative:** Use typed columns for core fields and a JSONB column for the variable remainder:

```sql
CREATE TABLE products (
    id          SERIAL PRIMARY KEY,
    name        VARCHAR(200) NOT NULL,
    price       DECIMAL(10,2) NOT NULL,
    category_id INT REFERENCES categories(id),
    attributes  JSONB DEFAULT '{}'
);
```

Rule of thumb: if you write `WHERE attributes->>'status' = 'active'` in most queries, `status` should be a proper column, not buried in JSON.

## Polymorphic associations

A polymorphic association uses a single [foreign key](/blog/primary-key-vs-foreign-key/) column plus a "type" column to reference rows in multiple different tables.

```sql
CREATE TABLE comments (
    id              SERIAL PRIMARY KEY,
    body            TEXT,
    commentable_id  INT,          -- could point to posts, photos, or videos
    commentable_type VARCHAR(50)  -- 'Post', 'Photo', or 'Video'
);
```

This pattern is common in Rails and Django ORMs. The problem: the database cannot enforce a foreign key constraint because `commentable_id` points to different tables depending on `commentable_type`. That means no CASCADE deletes, no referential integrity checks, and orphaned records that accumulate silently.

GitLab's engineering documentation explicitly recommends against polymorphic associations. The alternative: separate association tables per type.

```sql
CREATE TABLE post_comments (
    id      SERIAL PRIMARY KEY,
    body    TEXT,
    post_id INT REFERENCES posts(id) ON DELETE CASCADE
);

CREATE TABLE photo_comments (
    id       SERIAL PRIMARY KEY,
    body     TEXT,
    photo_id INT REFERENCES photos(id) ON DELETE CASCADE
);
```

More tables, but the database enforces every relationship. This is almost always the right trade-off for systems that need long-term data integrity.

## Multi-tenant patterns

Multi-tenancy decides how you isolate customer data when multiple organizations share the same application. There are three standard approaches, each with a different cost-isolation trade-off.

**Shared schema (pool model):** All tenants share the same tables. A `tenant_id` column on every table separates the data. Cheapest and simplest, but a missing `WHERE tenant_id = ?` filter can leak data across tenants.

**Schema-per-tenant:** Each tenant gets a separate schema within the same database instance. Supported in PostgreSQL and SQL Server, but not in MySQL. Bytebase's analysis [found that it introduces complexity comparable to database-per-tenant](/blog/multi-tenant-database-architecture-patterns-explained/) without proportional isolation benefits.

**Database-per-tenant (silo model):** Each tenant gets a fully separate database. Maximum isolation, but the highest operational cost. Managing schema migrations across hundreds of databases requires [dedicated tooling](/blog/how-to-handle-database-schema-change/).

| | Shared schema | Schema-per-tenant | Database-per-tenant |
|---|:-:|:-:|:-:|
| **Cost** | Lowest | Medium | Highest |
| **Data isolation** | Weakest | Medium | Strongest |
| **Per-tenant customization** | None | Some | Full |
| **Migration complexity** | One migration | Per-schema | Per-database |
| **Best for** | Startups, MVPs | Mid-tier SaaS | Enterprise, regulated industries |

Start with shared schema unless you have a compliance requirement (HIPAA, GDPR data residency) that demands physical isolation. PostgreSQL's [row-level security](/blog/postgres-row-level-security-limitations-and-alternatives/) can add a database-enforced isolation layer on top of application-level `tenant_id` filtering.

## Anti-patterns to avoid

These are the design decisions that cause production incidents.

**The God Table.** One table stores everything: users, orders, products, logs. It starts with 50 columns and grows to 200. Splitting into focused tables typically reduces query times by 80% or more.

**Missing primary keys.** Always use a [surrogate primary key](/blog/choose-primary-key-uuid-or-auto-increment/) (auto-increment integer or UUID). Natural keys like name + date of birth lead to collisions and mixed-up records.

**Over-normalization.** Splitting data across too many tables where simple queries require 10+ joins. A fintech startup decomposed currency codes, transaction types, and timestamp components into separate lookup tables, and the system collapsed under peak load.

**Storing money as FLOAT.** Floating-point arithmetic causes rounding errors. `0.1 + 0.2 = 0.30000000000000004` in most languages. Use DECIMAL(10,2) for monetary values.

**No indexes on filtered columns.** Index the columns that appear in your WHERE clauses and JOIN conditions, and use EXPLAIN to validate. Too many indexes slow writes; too few cause full table scans.

**Wrong data types.** Dates stored as VARCHAR prevent range queries. Enums stored as freeform strings allow typos. Use DATE/TIMESTAMP for times, DECIMAL for money, and ENUM or lookup tables for fixed value sets.

Getting the pattern right at the [schema design](/blog/top-database-schema-design-best-practices/) stage is cheaper than fixing it in production.

## How Bytebase helps enforce design patterns

[Bytebase](/) is a database DevSecOps platform that catches pattern violations before they reach production. Its [SQL review](/blog/what-is-sql-review/) policy can enforce rules like:

- [Every table must have a primary key](/blog/sql-review-rule-explained-require-primary-key/)
- Column naming must follow conventions (e.g., `_id` suffix for foreign keys, `_at` suffix for timestamps)
- [CASCADE operations must be explicitly approved](/blog/sql-review-rule-explained-prohibit-cascade/)
- Specific column types are required for specific data (TIMESTAMP for dates, DECIMAL for currency)

These rules run automatically on every [schema change](/blog/what-is-database-schema/) before it is applied, which means pattern violations get caught in review, not in a 3 AM incident.

## Further readings

- [Top 10 Database Schema Design Best Practices](/blog/top-database-schema-design-best-practices/)
- [What is a Database Schema?](/blog/what-is-database-schema/)
- [Multi-Tenant Database Architecture Patterns Explained](/blog/multi-tenant-database-architecture-patterns-explained/)
- [Primary Key vs Foreign Key](/blog/primary-key-vs-foreign-key/)
- [DDL vs DML in SQL](/blog/what-is-ddl-and-dml-in-sql-database/)
- [How to Handle Database Migration / Schema Change](/blog/how-to-handle-database-schema-change/)


The
Bytebase Blog

PostgreSQL 19 features I'm excited about

HIPAA Compliance

What SOC 2 Taught Us About Database Audit Logs

Explore the standard for database development

Solutions & Platform

Comparisons

Legal

Resources

Company

Solutions & Platform

Resources

Comparisons

Company

Legal

The Bytebase Blog

PostgreSQL 19 features I'm excited about

HIPAA Compliance

What SOC 2 Taught Us About Database Audit Logs

Explore the standard for database development

The
Bytebase Blog