Your agent can do
exactly what you can.
Signed in as you through MCP. The workspace policy sets a ceiling; your role sets another. The policy never grants.
MCP policyset by the workspace
Your roleset by the project
Assistant
bytebase ! Needs authentication
/mcp → bytebase → Authenticate
Opening browser…
✓ bytebase Connected as jane@acme.com
Assistant
Show me the schema of hr_prod.employee
get_schema · hr_prod
employee · 5 columns
id integer
name varchar(120)
email varchar(254) masked
salary numeric(10,2) masked
hired_at date
List the 10 most recent hires
query_database · hr_prod
SELECT name, email, salary
FROM employee ORDER BY hired_at DESC
LIMIT 10;
✗ permission denied to access
resources: hr_prod
request the SQL Editor role
on the project
Your role can't query hr_prod, and I can't request access for you — ask a DBA in the console.
Try again
query_database · hr_prod
name email salary
Jane Doe ****** ******
Omar Haddad ****** ******
Mei Lin ****** ******
…
✓ 10 rows · email/salary masked
DBA · Project › Members
Assistant
Fix the typo in row 1042
query_database · hr_prod
UPDATE employee SET name = 'Jane Doe'
WHERE id = 1042;
✗ MCP ceiling is READ_ONLY
ask an admin to raise it,
or run this in the console
Propose adding a nullable nickname column instead
propose_database_change · hr_prod
ALTER TABLE employee
ADD COLUMN nickname VARCHAR(50);
✓ Issue #412
Add nickname to employee
reviewed · needs approval
Waiting for DBA approval. I can't approve it.
Workspace admin · Integration › MCP › Access policy
Assistant
Run it
run rollout · prod
✗ 403 Not allowed to run tasks
Run it again
run rollout · prod
✓ Prod · DEPLOYED
+ nickname VARCHAR(50)
DBA · Environments › Prod › Rollout Policy
Assistant
session c7f3…
client Claude Code
user jane@acme.com
Audit Log
10:41rollout.run · prodjane · c7f3…
10:38rollout.run · prod — refusedjane · c7f3…
10:35propose_database_change · hr_prodjane · c7f3…
10:33query_database · hr_prod — refusedjane · c7f3…
10:31query_database · hr_prod — refusedjane · c7f3…
10:30query_database · hr_prodjane · c7f3…
bytebase.com/demo/mcp