A script applied by hand. Nothing records that it ran, nothing stops it running twice, nothing reviews it first.

Flyway or Liquibase tracks versions and applies in order — but it doesn't review the SQL, gate production behind approval, or promote across environments. That's the CI you still wire yourself.

Database-per-tenant means a single schema change has to land on every tenant database — the same way, every time. By hand that's a psql loop over dozens to thousands of databases, and the run that times out halfway leaves some tenants migrated and some not.

Dev, staging, and prod diverge the moment one change lands outside the pipeline, and you find out at the next deploy.

SQL review runs on the change before it applies — 200+ rules catch unsafe operations, missing indexes, and naming violations. The ruleset is strict on production, relaxed on dev.

The migration applies in dev, then staging, then production — and across a whole database group in one rollout, not a psql loop over every database. The same script meets progressively more realistic data. A failure stops the chain.

Approval gates sit between stages. Routine changes auto-promote into dev; production-bound DDL waits for a human who sees the SQL, the review results, and the rollout plan in one record.

Every applied migration is logged with version, environment, executor, and timestamp. Each entry keeps a schema snapshot, and schema sync compares any two databases and realigns them through the same pipeline.

GRANT is all-or-nothing. The full column or none of it — no “last four characters.”

Masking views multiply with every role. Every schema change ripples through the set.

A capable extension — where you can install it. Managed Postgres doesn't guarantee that, and labels must be maintained per cluster.

RLS hides rows; it doesn't transform values. Seeing the row but not the SSN needs masking.

Workspace rules, first match wins. Conditions on environment, project, database, and classification pick the algorithm — full, partial, MD5, range, custom.

Project-level override for a single column.

Time-bound Query or Export exemptions for named users. Every grant logged. Every access logged.

Nobody provisions a least-privilege role per agent for a five-minute setup. They paste the connection string they already have — the one that can read and drop anything.

Postgres sees a single login. Which agent ran that DELETE, on whose behalf, after which prompt? The audit trail is identical login records.

A keyword check that allows SELECT is no guard — COMMIT; DROP SCHEMA public CASCADE; closes the read-only transaction and runs the rest unguarded.

The agent reads data, ingests untrusted content, and sends it back out — the lethal trifecta in one shot. A scoped credential can't stop an injection that asks for data it's allowed to read.

The agent authenticates as itself, not as a connection string. Scope follows the identity — only the projects, databases, and tables its role allows.

Sensitive values are masked before they reach the model. A restricted SSN comes back as ******, so it can't leak what it never saw.

A change doesn't run on send. It opens a Bytebase issue, where SQL review and approval apply just as for a human-authored migration.

Database governance for PostgreSQL.

Schema Migration

Data Masking

MCP Server

Connect PostgreSQL

Explore the standard for database governance

Solutions & Platform

Resources

Change Management

Access & Security

AI & Agents

Comparisons

Company

Legal