# Database Governance for AI Agents

> Govern what AI agents read and write in your database. In Bytebase an agent authenticates with its own identity — a service account or workload identity — that inherits the same governance as a human user — just-in-time access, masking, and audit on reads, plus SQL review, approval, and rollback on writes — over MCP, across PostgreSQL, MySQL, SQL Server, and Oracle. Not vanilla IAM (auth only) or PAM (credential/session layer). Self-hosted, open-source.

Source: https://www.bytebase.com/database-governance-ai-agents/

---

## An agent gets its own identity, governed like a user.

AI agents access databases like a new kind of user — ephemeral, autonomous, at machine scale. In Bytebase an agent authenticates with its own identity — a service account or workload identity, never a shared credential — that carries the same database-aware policies as a human user, for reads and for writes. Cloud IAM authenticates and PAM brokers credentials, but neither applies SQL-layer controls.

## Writes: agent changes under change control.

### SQL review on every change

An agent's migration clears 100+ automated review rules — locking DDL, unsafe operations, backward-incompatible changes — before it can run.

### Risk-tiered approval

Dangerous changes route to a human; safe, bounded ones proceed, so an agent never ships a destructive migration unchecked.

### Deployed and reversible

Changes roll out through environments in order and carry a rollback plan — sequenced and reversible, not a one-way write.

## Five controls, across reads and writes.

### Identity

Each agent gets its own identity. Ephemeral, scoped, never shared with humans.

### Authorization

Just-in-time access. Granted per task — to query and to change — expired by default, never standing.

### Isolation

Production is its own environment tier with its own policy. A grant is scoped to one project and database, so a mistake stays where it happened.

### Audit

Every query and every change logged with the agent's intent and the human who initiated it.

### Masking

Sensitive columns redacted at query time. The agent sees what it needs, not the raw row.

## Read in order.

### Codify the context

What AI agents need beyond DDL. Schema as code is necessary, not sufficient. /blog/schema-as-code-to-schema-as-context

### Govern the reads

Identity, authorization, audit, masking applied to ephemeral autonomous agents. /blog/how-to-govern-ai-agent-access-to-enterprise-data

### Govern the writes

Review, approval, and rollback for schema and data changes an agent authors. /blog/governing-agent-authored-database-changes

## Get Started

- [Contact us](https://www.bytebase.com/contact-us/)
- [Start now (cloud)](https://console.bytebase.com)