Notes on the MySQL 9.7 LTS release: Hypergraph Optimizer in Community, JSON Duality View DML, Group Replication observability, and Dynamic Data Masking for Enterprise.

Notes on the MySQL 9.7 LTS release

Most DAC implementations stop at the connection. Real DAC operates at the statement and covers three vectors: machine, human, and AI agent.

What is Database Access Control (DAC)?

Practical guide to dynamic data masking: five best practices, a vendor comparison, an end-to-end walkthrough, and the compliance specifics auditors ask about.

Dynamic Data Masking Best Practices

How Bytebase audits the workflow layer: every SQL, schema change, approval, and export tied to a real user identity, with structured exports for any SIEM.

How Bytebase Handles Audit Logging

PostgreSQL 19 features I'm excited about: planner advisor framework, DDL extraction, online REPACK, pg_stat_recovery, parallel autovacuum, sequence sync, and 64-bit MultiXact.

PostgreSQL 19 features I'm excited about

Bytebase is HIPAA-compliant — independent verification that our administrative, physical, and technical safeguards meet the HIPAA Security Rule for handling Protected Health Information.

HIPAA Compliance

PAM tools gate connections; databases also need SQL review, schema change workflow, and statement-level approval. Why most teams use PAM with Bytebase.

Bytebase vs. PAM: Why Database Teams Need More Than Privileged Access Management

What SOC 2 compliance audits actually want from your database audit log — not 'logging enabled' but evidence your auditor will accept. Lessons from going through our own audit.

SOC 2 Audit Log Requirements: Lessons From Our Own Audit

Bytebase vs. Atlas compared across migration approach, CI/CD, access control, and pricing. Updated for Atlas v1.1 and Bytebase 3.16.

Bytebase vs. Atlas: a side-by-side comparison for database schema migration

Audit-surviving database access control: statement-level enforcement across machine, human, and AI agent workloads, with the mistakes that fail SOC 2.

Database Access Control (DAC) Best Practices

SOX Section 404 requires IT general controls over database changes. Learn the ITGC domains, six audit questions teams fail, and how to build SOX-ready controls

Database Change Management for SOX Compliance

TRUNCATE and DELETE both remove rows, but they differ in speed, rollback behavior, and locking. Compare how they work in PostgreSQL, MySQL, and SQL Server.

TRUNCATE vs DELETE in SQL: Differences Across PostgreSQL, MySQL, and SQL Server

Six database design patterns for production systems: normalization, star schema, EAV, polymorphic associations, multi-tenancy, and anti-patterns.

Database Design Patterns Every Developer Should Know

pgvector adds vector storage and similarity search to PostgreSQL. Learn how to install it, query embeddings, build indexes, and decide when it is enough.

pgvector: How to Add Vector Search to PostgreSQL

Upsert inserts or updates a row based on key conflicts. Learn MySQL INSERT ON DUPLICATE KEY UPDATE, PostgreSQL ON CONFLICT, and SQL Server MERGE.

Upsert in SQL: INSERT ON DUPLICATE KEY vs ON CONFLICT Explained

AI agents need more than DDL. The full database lifecycle codified — schema, dependencies, ownership, history — gives LLMs the context to query correctly.

From Schema as Code to Schema as Context

Learn how to find and fix slow MySQL queries using the slow query log, EXPLAIN, index tuning, and query rewrites, with practical examples for each.

How to Fix Slow MySQL Queries: A Practical Guide

A detailed comparison of Convex and Supabase covering architecture, real-time capabilities, data model, pricing, and schema management to help you choose.

Convex vs Supabase: Which Backend Platform Should You Choose?

Blue-green deployments work cleanly for stateless apps. Databases are stateful. Learn what makes database blue-green deployments hard and how to do them safely.

Database Blue-Green Deployment: A Practical Guide

The 10 best data management tools in 2026 — database GUI clients, schema migration tools, data pipelines, and analytics platforms compared with pricing.

Top 10 Data Management Tools in 2026

How to give AI agents governed access to your databases. Identity, authorization, query control, audit, and masking — applied to a new principal type.

How to Govern AI Agent Database Access

Postgres-only SQL editors are designed specifically for Postgres databases, providing a more focused and efficient experience for Postgres users. In this post, we are taking a look at the top Postgres-only SQL editors in 2026.

Enterprise Text-to-SQL: Context, Evaluation, and Governance

Database deployment tools for devops teams in 2026.

Database Deployment Tools for DevOps Teams in 2026

Schema change detection and notification are essential for data pipelines. This article explains why a simple column rename can break your data pipeline and how to prevent it.

Schema Change Detection and Notification: Why a Simple Column Rename Can Break Your Data Pipeline

A comprehensive guide to understanding and analyzing Postgres query plans.

Postgres Query Plan: How to Read and Fix Performance Issues

This article explores the anatomy of Postgres permissions ERROR 42501.

The Anatomy of Postgres Permission ERROR 42501

Postgres Logs Explained: A Practical Guide for Production

Postgres 19 widens MultiXactOffset to 64 bits, eliminating the hidden 4 billion member limit that caused catastrophic outages for high-concurrency workloads.

Postgres 19 Feature Preview: 64-bit MultiXactOffset

A guide to MySQL schema migration best practice.

MySQL Schema Migration Best Practice

Postgres 19 introduces automatic sequence synchronization for logical replication, eliminating manual tracking and making major version upgrades and failover significantly easier.

Postgres 19 Feature Preview: Sequence Synchronization for Logical Replication

A guide to multi-environment deployments in databases.

Database Multi-Environment Deployments - The Challenges and Patterns

A guide to open source sensitive data discovery tools — from NLP libraries like spaCy and Microsoft Presidio to multi-source scanners like Hawk-Eye and full metadata platforms like OpenMetadata.

Top Open Source Sensitive Data Discovery Tools in 2026

Database audit logging has two layers: infrastructure (provider-managed) and workflow (database activity). What each captures, and why compliance requires both.

Database Audit Logging: Two Layers, One Trail

A practical guide to HITRUST database compliance covering access control, audit logging, change management, and data protection.

Database Compliance for HITRUST: Controls, Risks, and Best Practices

Learn why requiring a primary key is important and how the "Require Primary Key" review rule protects your production database.

Require Primary Key: A SQL Review Rule Explained

Learn why enforcing NOT VALID in CHECK constraints is important and how the "Enforce NOT VALID in CHECK" review rule protects your production database.

Enforce NOT VALID in CHECK: A SQL Review Rule Explained

Postgres Audit Logging Guide

Learn why CASCADE operations in SQL can lead to catastrophic data loss and how the "Prohibit CASCADE" review rule protects your production database.

Prohibit CASCADE: A SQL Review Rule Explained

A comprehensive guide on migrating from Supabase to AWS, covering database, auth, storage, functions, realtime, and networking.

How to Migrate from Supabase to AWS

Top open-source Postgres backup solutions for 2026.

What is Enterprise Database Management (EDM)?

What is Postgres Transaction ID (XID) Wraparound and how to monitor and prevent it.

Postgres Transaction ID (XID) Wraparound

How a CI/CD pipeline for database schema migration works end-to-end — what it gates, what it leaves outside, and the tools that fit.

How to Build a CI/CD Pipeline for Database Schema Migration

A practical guide to shipping features efficiently using PostgreSQL, covering development workflows, best practices, and real-world examples

How I Ship Features with Postgres

A comprehensive overview of the essential practices and principles necessary for achieving LGPD (Brazilian General Personal Data Protection Act), compliance within database operations, and its difference with GDPR

Database Compliance for LGPD: Implications and Best Practices

Explain what is Postgres LATERAL JOIN and how to use it.

What is Postgres LATERAL JOIN?

Introduction to MySQL Online DDL and its three algorithms: INSTANT, INPLACE, and COPY

MySQL Online DDL: A Practical Guide

List of open source postgres connection poolers

Open Source Postgres Connection Pooler

A comprehensive guide to understanding the dilemma of singular vs. plural table naming in SQL databases.

SQL Table Naming Dilemma: Singular vs. Plural

PostgreSQL 18 features that change how application developers write and ship code.

What's New in PostgreSQL 18: A Developer's Perspective

Explore Snowflake Dynamic Data Masking capabilities and compare with alternative data masking solutions

Snowflake Dynamic Data Masking (DDM) and Alternatives

Top open-source Postgres authentication solutions for 2025.

Postgres Case Sensitivity Explained

A comprehensive guide to understanding pg_database_owner in Postgres

What is pg_database_owner in Postgres

Which operation causes a Postgres table rewrite

Which Postgres Operation causes a table rewrite

An engineering perspective to evaluate Postgres row-level-security footguns

Postgres Row-Level Security Footguns

An engineering perspective to evaluate Postgres rollback strategies

Postgres Rollback Explained

Learn how Postgres locks affect schema migrations and which DDL operations conflict with DML to achieve zero-downtime deployments.

Postgres Schema Migration without Downtime

A checklist of gh-ost limitations and potential gotchas

gh-ost Limitations You Need to Know Before Production

5 quick wins for application developers to improve Postgres reliability and make both their own and DBA/infrastructure teams' lives easier.

5 Postgres Production Tips for Application Developers

Learn how to use CREATE INDEX CONCURRENTLY in Postgres to build indexes without blocking writes. Pitfalls, safety checks, and performance tips.

How to Use Postgres CREATE INDEX CONCURRENTLY

An extensive comparison between Supabase and MongoDB on performance, usability, operability, ecosystem and more.

Supabase vs. MongoDB: a Complete Comparison in 2025

When evaluating database management tools, DataGrip and Bytebase represent two different philosophies: individual developer productivity versus team collaboration and governance.

Bytebase vs. DataGrip: a side-by-side comparison for database management

Supabase pricing starts free. We break down real costs for Pro ($25/mo) and Team ($599/mo) plans, explain overages, and compare each service head-to-head with AWS.

Supabase vs AWS: Feature and Pricing Comparison (2026)

Is Supabase free? Compare Supabase pricing vs AWS RDS and Aurora across free tier, Pro, and production plans. Includes Supabase free tier limits, storage costs, and compute pricing for 2026.

Supabase Pricing vs AWS RDS: Is Supabase Free? Full Cost Comparison (2026)

Learn how Bytebase enables organizations to implement comprehensive Database Security Lifecycle Management, unifying security and operations from development to production.

Database Security Lifecycle Management

Areas where MySQL shines and Postgres falls short.

Features I Wish Postgres Had but MySQL Already Has

Areas where PostgreSQL shines and MySQL falls short.

Features I Wish MySQL Had but Postgres Already Has

This guide focuses on HIPAA compliance at the database layer, providing healthcare organizations and database teams with practical guidance for implementing HIPAA Security Rule requirements.

HIPAA Data Security and Retention Requirements

Compare the online index creation difference between Postgres and MySQL

Postgres vs. MySQL: Online Index Creation

SOC 2 Data Security and Retention Requirements for Database Systems and How Bytebase Helps

SOC 2 Data Security and Retention Requirements

Compare the different indexing options between Postgres and MySQL

Postgres vs. MySQL: Indexing Options

Compare the JSON support difference between Postgres and MySQL

Postgres vs. MySQL: JSON Support

While PostgreSQL RLS is a powerful feature, it has inherent design limitations that hinder broader adoption. In this post, we’ll examine these limitations and explore alternatives.

Postgres Row-Level Security (RLS) Limitations and Alternatives

Evaluate several database schema diagram tools, and help you to choose the right one for 2025

Top 4 Free, Open Source Database Schema Diagram Tools to Visualize Database Easier in 2025

An overview of the most popular text-to-SQL AI tools in 2026, including DataGrip, TablePlus, SQL Chat, Vanna.ai, SQLAI.ai, Postgres.new, and DBHub MCP server. Compare features and capabilities to find the best SQL AI assistant for your workflow.

Top 5 Text-to-SQL Query Tools in 2026

Compare the DDL transaction difference between Postgres and MySQL

Postgres vs. MySQL: DDL Transaction Difference

Evaluate several TypeScript ORMs, and help you to choose the right one for 2025

Top TypeScript ORM 2025

Evaluate Prisma and TypeORM, and help you to choose the right TypeScript ORM for 2025

Prisma vs TypeORM: The Better TypeScript ORM in 2025

PostgreSQL 18 features and what they change for running production databases.

What's New in PostgreSQL 18: A DBA's Perspective

Explore alternatives to Amazon RDS, including 

RDS Alternatives in 2025

An extensive comparison between DynamoDB and Cassandra on performance, usability, operability, ecosystem and more.

DynamoDB vs. Cassandra: a Complete Comparison in 2025

An extensive comparison between DynamoDB and MongoDB on performance, usability, operability, ecosystem and more.

RDS vs. DynamoDB: a Complete Comparison in 2025

How gh-ost and pt-online-schema-change compare on architecture, cut-over, foreign keys, and runtime control — for teams choosing a MySQL online schema migration tool.

gh-ost vs pt-online-schema-change

GitHub and Bitbucket are both tools for code collaboration. This article compares the features and pricing of GitHub and Bitbucket.

GitHub vs Bitbucket:a Complete Comparison in 2025

Drizzle ORM vs Prisma comparison: type safety, performance, bundle size, serverless support, migrations, and ecosystem. Find out which TypeScript ORM is right for your project in 2026.

Drizzle ORM vs Prisma: Which TypeScript ORM Should You Use in 2026?

An engineering perspective to evaluate Google AlloyDB and Cloud SQL, and help you to choose the right Google Cloud database for 2025

AlloyDB vs. Cloud SQL: engineering guide to choose the right Google Cloud database for 2025

Understanding DynamoDB Pricing (2025)

A simple comparison of AWS Aurora versus RDS pricing in 2025, helping you understand key differences and choose the right database service for your needs and budget.

AWS Aurora vs. RDS Pricing: A Detailed Comparison 2025

Infrastructure as Code security tools help organizations identify vulnerabilities and misconfigurations in their infrastructure definitions. This post explores the top open-source IaC security tools available in 2025.

Top Open Source Infrastructure as Code (IaC) Security Tools in 2025

Compare the price of the mainstream managed PostgreSQL hosting providers

PostgreSQL Hosting Options in 2025: Pricing Comparison

Complete guide to AWS Aurora pricing: instance types and costs, Aurora Serverless v2 pricing, I/O-Optimized vs Standard, reserved instance savings, and real-world cost examples. Learn how to optimize your Aurora costs.

AWS Aurora Pricing Explained: Instance Types, Serverless, and Cost Optimization (2026)

Database governance tools help organizations manage database changes, enforce policies, and maintain data quality. This post explores the top open-source database governance tools available in 2025.

Top Open Source Database Governance Tools in 2025

Workflow orchestration tools help coordinate tasks, handle errors, and monitor execution processes. In this post, we are taking a look at open source workflow orchestration options

Top Open Source Workflow Orchestration Tools in 2025

Understanding AWS RDS Pricing (2025)

Compare the price of the mainstream managed MySQL hosting providers

MySQL Hosting Options in 2025: Pricing Comparison

A comprehensive guide to the best open-source Kubernetes cluster management tools in 2025, including Argo CD, Karmada, Sveltos, and Plural.

Top 4 Open Source Kubernetes Cluster Management Tools in 2025

An extensive comparison between GitLab CI and GitHub Actions on features, performance, and more.

GitLab CI vs. GitHub Actions: a Complete Comparison in 2025

Review the state of the Golang ORM and query builder

Choose the Right Golang ORM or Query Builder in 2025

Database access control (DAC) is the set of policies and mechanisms that decide **who** can connect to a database, **what** they can do, and **for how long**. Most implementations stop at the connection — and the connection is not where the damage happens. The statement is.

```mermaid
flowchart LR
 U(["User / app / agent"]) -->|"connect"| A["Authentication once at connection Who are you?"]
 A -->|"identity verified"| Z["Authorization every statement What can this SQL do?"]
 Z -->|"allowed"| D[("Database")]
 A -.->|"fail"| X["Connection rejected"]
 Z -.->|"fail"| Y["Statement rejected"]
 Z -->|"next SQL"| Z

 A ==>|"log"| L[("Audit log every decision, pass or fail")]
 Z ==>|"log"| L

 style A fill:#dbeafe,stroke:#1d4ed8
 style Z fill:#dcfce7,stroke:#15803d
 style L fill:#fef3c7,stroke:#a16207
```

Authentication is a one-time gate at connection. Authorization fires on every statement — and this is where most real-world DAC fails. A user with a valid connection and a broadly-scoped role can do anything the role allows, with no further check on the actual SQL.

_Note: "DAC" is also used in security literature for [discretionary access control](https://en.wikipedia.org/wiki/Discretionary_access_control), the access-control model contrasted with MAC and RBAC. This article uses DAC for database access control throughout._

## Machine, human, and agentic access are three different problems

The biggest source of DAC failure is applying one playbook to fundamentally different workloads. There are three.

**Machine to database.** Application servers, ETL pipelines, scheduled jobs. Predictable, repeated, scoped to known tables. Machine accounts get narrow, permanent permissions deployed alongside the application. Their access shape changes at the speed of releases.

**Human to database.** Schema changes, data corrections, ad-hoc queries, incident response, admin operations. Unpredictable, varied, and where most production incidents originate. Human accounts need broad capabilities — but only at specific moments, only for a stated reason, and always with a per-action audit trail. Their access shape changes at the speed of on-call rotations, team movements, and outages.

**Agent to database.** Coding assistants, MCP-connected copilots. Intent comes from a natural-language prompt; the SQL is generated on the fly. Operates at machine speed but produces human-shaped queries — novel, varied, occasionally destructive. Acting on behalf of a person, which means the audit record needs two identities: the agent's service account _and_ the requesting principal. Access shape changes at the speed of prompts.

All three share the principles (least privilege, named identity, full audit) and diverge sharply on implementation. The generic DAC advice — set up roles, grant `SELECT` on the tables they need — works cleanly for machines. For humans, it produces either standing privileges nobody can justify or developer toil that drives teams to share an admin account. For agents, it produces the worst of both: a service account with machine-shaped permanence but human-shaped unpredictability — and no record of which prompt produced which `DELETE`.

## A working DAC system answers four questions

For every active grant — machine, human, or agent:

1. **Who** is connecting? A named individual, workload identity, or agent — and for agents, the requesting principal must be recorded alongside the service account.
2. **What** can they do? Read, write, alter schema, grant permissions to others.
3. **Where** can they do it? Which databases, schemas, tables, columns.
4. **How long** does the access last? Permanent, [time-boxed, or on-demand](/blog/just-in-time-database-access/).

If you cannot answer all four for an active grant, that grant is a gap. The fourth question is the one most often missing: standing access accumulates because nobody set a clock on it, and "temporary" grants rarely stay temporary.

## Where connection-time control stops short

Privileged Access Management (PAM), VPNs, and bastion hosts all gate the connection. That is necessary and not sufficient. Two failure modes survive a clean connection gate:

- **Untracked actions inside an approved session.** A user with a valid two-hour grant runs 200 queries; only one of them drops a table. Session-level logs prove the user was connected; they do not answer _"which statement, at what time, with what result"_. Compliance auditors ask the second question.
- **Sensitive data flowing through approved channels.** A role-based grant says the user can `SELECT` from `customers`. It does not say whether `customers.tax_id` should be masked for this user. Column-level policy and [dynamic masking](/blog/what-is-dynamic-data-masking/) live outside `GRANT`/`REVOKE` and have to be enforced at statement time.

Connection-time DAC misreads where the risk lives. The unit of risk is not the session — it is the statement. Every statement is a control point.

## Compliance requires the statement-level answer

Every major compliance framework requires database-level access controls — and the audit findings concentrate on the same three gaps regardless of framework:

| Framework | Access control requirement | Audit trail required? |
| -------------------- | ---------------------------------------------- | --------------------- |
| SOC 2 (CC6.1, CC6.3) | Least privilege, regular access reviews | Yes |
| HIPAA (§164.312) | Unique user IDs, emergency access procedures | Yes |
| GDPR | Access limited to purpose of processing | Yes |
| PCI DSS (Req 7, 8) | Role-based access, no shared accounts | Yes |
| SOX | Separation of duties, change audit trails | Yes |
| ISO 27001 (A.9) | Formal access provisioning and de-provisioning | Yes |

What teams fail on is rarely the policy text. It is shared service accounts that hide who actually ran the query, standing privileges nobody can justify, and [audit trails](/blog/database-audit-logging/) that record sessions but not statements.

## The Bytebase shape

[Bytebase](/) treats database access control as a statement-level workflow problem, not a connection-level RBAC problem. Identity, permissions, masking, approval, and audit all act on the same surface: the SQL a user is about to run. Machine workloads connect through the same identity model with first-class service accounts. Human workloads route through approval chains, time-boxed grants, and a per-statement audit log. AI agents operate through service accounts that inherit the same statement-level review, masking, and audit as humans — and the requesting person is bound to every action the agent takes, so the audit trail answers _"which prompt produced this query"_, not just _"which service account ran it."_

For the principles that translate this shape into day-to-day practice — least privilege, separation of duties, just-in-time access, RBAC, and the common mistakes that fail audits — see [Database Access Control Best Practices](/blog/database-access-control-best-practices/).

Production-grade dynamic data masking (DDM) needs five things: role-based policies, column-level granularity, an unmask audit trail, code-reviewed policy changes, and cross-environment consistency. The engine you pick (SQL Server, Snowflake, Postgres, or a fleet-wide layer) matters less than these five practices; getting any one wrong is what fails the next audit. This guide covers each, the trade-offs between native DDM and fleet-wide tools, and an end-to-end walkthrough.

<HintBlock type="info">

New to dynamic data masking? Start with our [What is Dynamic Data Masking](/blog/what-is-dynamic-data-masking/) explainer first. This guide assumes you've decided to implement DDM and want to do it well.

</HintBlock>

## When you actually need dynamic data masking

DDM solves a specific problem: giving non-prod-cleared users (engineers, analysts, support reps, AI agents) access to production data shape without exposing production data values. If you don't have that exact need, you probably don't need DDM.

The decision matrix:

| Situation | Right tool | Why |
| ---------------------------------------------------------------------- | ------------------ | -------------------------------------------------------------------- |
| Engineers debug prod issues with read-only access | **DDM** | Real values risk leak; structure preserved is enough |
| Cloning prod to staging | **Static masking** | Values gone forever, no runtime cost, no policy maintenance |
| Support rep should see customers in their region only | **RLS** | Issue is which *rows*, not which *values* |
| Stop external attackers from reading PII | **Encryption** | DDM bypassed by `pg_dump` and replicas; encryption travels with data |
| AI agent needs to query against real schema for prompt-engineering | **DDM** | Mask values; preserve column shape and join behavior |

### Compliance triggers

| Regulation | Clause | What it requires | DDM alone enough? |
| -------------- | ---------------------------- | ----------------------------------------------- | ----------------- |
| **GDPR** | Art. 25, Art. 32 | Data minimization at access | No. Pair with access controls and audit logging |
| **HIPAA** | Safe Harbor de-identification | 18 identifiers removed/obscured | Yes for non-PHI access; no for de-identified datasets |
| **SOC 2** | CC6.1 | Logical access controls over sensitive data | No. Auditors want evidence of who unmasked when |
| **PCI DSS** | Req 3.4 | Render PAN unreadable wherever stored | No. PCI requires encryption at rest, not just masking |

## 5 best practices for production DDM

### 1. Mask by role, never by individual user

**Failure pattern:** policies defined per user (`alice@company.com`, `bob@company.com`) become unmanageable past ~50 people, and create a permission gap every time someone leaves.

Define masking policies against roles (`support`, `engineering`, `compliance`), not individuals. Manage role membership in your IdP (Entra ID, Okta, Google Workspace) and let it cascade. SQL Server example:

```sql
CREATE TABLE customers (
 id INT,
 email NVARCHAR(100) MASKED WITH (FUNCTION = 'email()'),
 ssn CHAR(11) MASKED WITH (FUNCTION = 'partial(0,"XXX-XX-",4)')
);

GRANT UNMASK ON dbo.customers TO compliance_role;
```

The `UNMASK` privilege is granted to the role, not to `alice@company.com`. When Alice changes teams, removing her from the role removes her unmask access. No DDL change required.

Fleet-wide tools take this further: members can be IdP groups directly (e.g. `group:compliance@company.com`), so role membership stays in your IdP and never gets duplicated into per-engine GRANT statements.

### 2. Use column-level granularity, not table-level

**Failure pattern:** masking the whole `users` table when only `email`, `phone`, and `ssn` need masking. Engineers lose access to non-sensitive columns they need for debugging, then ask for unmask privilege "temporarily" until it becomes permanent.

Tag columns by sensitivity (`pii`, `financial`, `health`) and apply masks only to tagged columns. Most native DDM implementations support this directly:

```sql
-- Snowflake example
CREATE MASKING POLICY mask_email AS (val STRING) RETURNS STRING ->
 CASE
 WHEN CURRENT_ROLE() IN ('COMPLIANCE') THEN val
 ELSE REGEXP_REPLACE(val, '.+@', '****@')
 END;

ALTER TABLE customers MODIFY COLUMN email
 SET MASKING POLICY mask_email;
```

Apply the same policy to every email column in the schema. Don't write per-table policies that drift over time.

At fleet scale this is easier with classification tags than per-column policies. Tag the column once as PII, write one rule that masks every PII-tagged column across every database.

### 3. Audit who unmasked, not just who queried

**Failure pattern:** compliance asks "who saw real PII last quarter?" The team can answer "everyone who queried the table" but not "everyone who saw unmasked values." Mask events and unmask events are different access events.

Log both. The minimal audit record:

```
timestamp | user | role | query_id | columns_unmasked | row_count
```

In native DDM this requires joining the database audit log (`pgaudit`, SQL Server Audit, Snowflake `ACCESS_HISTORY`) against the role-resolution function for that query. In a fleet-wide tool, every unmask request, exemption change, and rule change lands in one audit table; you query it once for the SOC 2 evidence. With native DDM you reconstruct it from per-engine logs joined against IdP role history. SOC 2 and HIPAA auditors ask for this evidence specifically; without it, your DDM implementation is theoretical.

### 4. Make masking policy changes code-reviewed, not console-clicked

**Failure pattern:** mask configurations changed via a database GUI leave no diff. A `DROP MASKING POLICY` run from SSMS or pgAdmin disappears the moment the connection closes, and the next quarterly audit can't reconstruct who changed what.

Treat masking policies the way you treat schema migrations: version-controlled, reviewed by a second person, applied through a change pipeline. A policy diff in code review showing `DROP MASKING POLICY mask_email` is impossible to miss. The same change clicked through SSMS is invisible until the audit.

### 5. Plan for cross-environment policy drift

**Failure pattern:** prod has the mask, staging doesn't. A schema migration adds a new PII column with a mask in prod but no mask in dev. Engineers debugging from the un-masked environment treat the data as production-equivalent and pull it into spreadsheets, tickets, or AI prompts without realizing it's raw.

Two patterns drive most of this drift:

- **New columns ship with PII and no mask.** Fix: a CI check that asserts every column tagged `pii` has a mask defined. Fail the build otherwise.
- **Manual policy edits in one environment don't replicate.** Fix: apply changes through a pipeline that promotes dev → staging → prod, never directly to prod.

The cleanest fix is to make rules workspace-level with environment as a condition variable, so one rule applies fleet-wide and per-environment differences are explicit in the CEL rather than enforced by N parallel deployment pipelines.

## DDM tools comparison

| Capability | SQL Server | Snowflake | Oracle | PostgreSQL | MySQL | Bytebase / Immuta |
| ------------------------------------- | ---------- | --------- | ------ | ------------- | ------------- | ----------------- |
| Native column-level masking | ✅ | ✅ | ✅ | Via `anon` ext | Enterprise only | Cross-DB layer |
| Role-based policy | ✅ | ✅ | ✅ | DIY | DIY | ✅ |
| Conditional masking (per query context) | Limited | ✅ | ✅ | DIY | DIY | ✅ |
| Audit-log integration | Manual | ✅ | ✅ | DIY | DIY | ✅ |
| Code-reviewed policy changes | ❌ SSMS clickops | Via Terraform | Via DBMS_REDACT scripts | DIY | DIY | ✅ native |
| Cross-database fleet management | ❌ | N/A (single-vendor) | ❌ | ❌ | ❌ | ✅ |

A few non-obvious gotchas:

- **SQL Server's DDM was designed as obfuscation, not security**, per Microsoft's own documentation (still the current guidance in 2026). It can be bypassed via inference attacks (e.g. `WHERE ssn LIKE '123%'` reveals values byte-by-byte without ever unmasking). Pair it with row-level security or query filters.
- **Snowflake's masking policies execute server-side**, but the unmask audit lives in `ACCESS_HISTORY`, which lags by 1–2 hours. Real-time alerting needs a workaround.
- **PostgreSQL 17 still has no native DDM as of 2026.** The `anon` extension is mature but needs extension privileges that most managed services don't grant. App-layer masking via views + role-based grants is the common alternative.

Native DDM is sufficient for a single-vendor team. A fleet-wide layer (Bytebase, Immuta, Privacera) earns its keep when you run multiple database engines, need code-reviewed policy changes, or want fleet-wide audit evidence in one report.

## Common pitfalls

- **DDM doesn't protect from `pg_dump` / `mysqldump`.** Backups bypass the masking layer entirely. Mask + encrypt at rest, never one alone.
- **Replicas can leak unmasked data.** If the mask is computed at the leader, the replica sees raw values. Apply masking via views or extensions that replicate.
- **"Mask, then index" is a footgun.** A B-tree index on a masked column reveals the mask pattern; a query like `WHERE email_masked LIKE 'j%'` infers the original.
- **AI agents can reconstruct masked values via aggregation.** This became a real risk in 2024-2025 as LLM-based query agents proliferated. Inference attacks (`COUNT(*) WHERE ssn = 'X'` for each candidate `X`) bypass masking. Throttle or audit aggregate queries from non-cleared roles.

## Implementing DDM with Bytebase: an end-to-end walkthrough

A common scenario: mask `email`, `phone`, and `ssn` in a `customers` table so the `support` group sees `j***@example.com` but the `compliance` group sees the real value, with all unmask events logged. The same setup works across every engine Bytebase supports (Postgres, MySQL, SQL Server, Oracle, Snowflake, MongoDB, and the rest of the fleet), because masking lives at the SQL Editor layer rather than inside any one database.

**Prerequisite. Set up the taxonomy (one-time workspace setup).**

- **Semantic types** (Workspace Settings → Semantic Types): define the masking algorithms you'll reference from rules. Each semantic type has a name (e.g. `full-mask`, `email-partial`, `ssn-last-four`) and an algorithm config: full mask, range mask, MD5 hash, or inner/outer mask. This is required.
- **(Optional) Data classification** (Workspace Settings → Data Classification): define the levels (e.g. Level 1 Public through Level 4 Restricted), then tag columns like `email`, `phone`, `ssn` with the right level. This lets one rule cover every Level-3 column fleet-wide. Skip if you'd rather match columns by name in the rule.

**Step 1. Define global masking rules.** Masking rules are workspace-level. Each rule pairs a **CEL condition** (which columns to mask) with a **semantic type id** (which user-defined algorithm to apply). Conditions can match by column name, table, database, instance, environment, project, or classification level, alone or combined. For example:

```yaml
# By column name. No classification required.
- title: Mask SSN columns
 condition: 'resource.column_name == "ssn"'
 semantic_type: ssn-last-four

# By classification level. One rule, fleet-wide coverage.
- title: Mask all Level-3 columns
 condition: 'resource.classification_level >= 3'
 semantic_type: full-mask

# Stricter in prod, lighter in staging.
- title: Per-environment masking
 condition: 'resource.environment_id == "prod" || (resource.environment_id == "staging" && resource.classification_level >= 3)'
 semantic_type: full-mask
```

Three ways to apply: define rules directly in the Bytebase UI, call the REST API (e.g. from a GitHub Actions workflow on PR merge), or manage them through the Terraform provider (`bytebase_policy` resource with `type = "MASKING_RULE"`). Every policy change is captured in the audit log with actor, timestamp, and diff, regardless of which path you use. That's the evidence Best Practice #4 calls for.

**Step 2. Add a permanent masking exemption** for users who always need unmasked access (e.g. compliance). Exemptions are project-level: members + a CEL condition. Apply via the same UI, Terraform (`bytebase_policy` with `type = "MASKING_EXEMPTION"`), or REST API path used for rules.

```yaml
members:
 - group:compliance@company.com
condition: resource.database_name == "customers"
```

**Step 3. Use just-in-time access for one-off unmask requests.** Enable JIT once per project under Project Settings → **Allow just-in-time access**. From the SQL Editor, the user clicks **Request just-in-time access**, picks the databases, checks *Unmask*, sets a duration (1h to 7d or custom), and writes a reason. The request goes through the project's approval flow and expires automatically. No manual revoke.

**Step 4. Query the audit log** to verify which members accessed unmasked values, when, and against which columns. JIT requests, exemption changes, and rule changes all land here. The output is the evidence you hand to a SOC 2 auditor without preparation. With native DDM, the same evidence is a forensic exercise across the database audit log and IdP group membership history.

## FAQ

### What's the difference between dynamic data masking and Row-Level Security?

DDM controls which **values** a user sees in returned rows. RLS controls which **rows** a user can query at all. They solve different problems and are usually combined: a support agent might use RLS to see only their region's customers, plus DDM to see masked SSNs within that region.

### Does dynamic data masking slow down queries?

Most native DDM implementations add 1–5% per-query overhead, small enough that it's rarely the bottleneck. The expensive case is conditional masking on a heavily aggregated query, where the masking function runs once per row before aggregation. Test with your actual query patterns before assuming the overhead is negligible.

### Can dynamic data masking be bypassed?

Yes, and this is the most important thing teams underestimate. SQL Server DDM is bypassed via inference (`WHERE ssn LIKE '123%'`). Native DDM is bypassed by `pg_dump`, replicas, and backups. AI agents bypass it via aggregation queries. The only defense is layering: DDM + RLS + encryption at rest + audit logging + query rate limits.

## Closing

The engine you pick is one part of the system. Whether your DDM implementation holds up under audit depends on the audit trail, the change-review workflow, and cross-environment consistency around it.

## Related reading

- [What is Dynamic Data Masking (DDM)](/blog/what-is-dynamic-data-masking/)
- [Data Masking for PostgreSQL Databases](/blog/postgres-data-masking/)
- [Data Masking for MySQL Databases](/blog/mysql-data-masking/)
- [Snowflake Dynamic Data Masking and Alternatives](/blog/snowflake-dynamic-data-masking-and-alternatives/)
- [Database Access Control Best Practices](/blog/database-access-control-best-practices/)
- [Postgres Audit Logging Guide](/blog/postgres-audit-logging/)
- [SOC 2 Data Security and Retention Requirements](/blog/soc2-data-security-and-retention-requirements/)


Database audit logging has two layers. The **infrastructure layer** captures provider-managed actions: provisioning, configuration, backups. The **workflow layer** captures actions inside the database: schema changes, queries, approvals, exports. Why compliance requires both is covered in [Database Audit Logging: Two Layers, One Trail](/blog/database-audit-logging/).

Bytebase covers the workflow layer. What follows is how.

## How Bytebase Closes the Three Gaps

```mermaid
flowchart LR
    subgraph EN["Engine-native auditing"]
        direction TB
        EI["❌ app_user"]
        EC["❌ SQL only"]
        EV["❌ per-engine format"]
    end

    subgraph BB["Bytebase"]
        direction TB
        BI["✅ SSO end user"]
        BC["✅ SQL + ticket + approver"]
        BV["✅ one unified schema"]
    end

    EI -->|Identity| BI
    EC -->|Context| BC
    EV -->|Coverage| BV

    style BB fill:#e0f2fe,stroke:#0369a1
```

Engine-native auditing leaves three gaps: identity, context, coverage. Bytebase closes each because it sits in front of the database, not inside it.

**Identity.** Bytebase records the SSO-mapped end user. Users authenticate to Bytebase before any SQL is issued, so attribution survives the shared `app_user` connection where engine-native logs lose it.

**Context.** Bytebase pairs every SQL execution with the approval chain, project, and issue ID. The justification is captured at change time, alongside the SQL, not reconstructed later when an auditor asks.

**Coverage.** Bytebase emits one audit schema across PostgreSQL, MySQL, SQL Server, Oracle, and the rest. Capture happens at the gateway, so a multi-engine fleet produces a single-format trail.

## What Bytebase Records

Six categories of events:

- **SQL execution** — every query through SQL Editor or change rollouts, with full SQL text, target database, parameters, and execution result
- **Schema changes** — issue creation, approval decisions, rollout status, rollback
- **Data access** — queries and exports tied to the requesting user, including row count and export destination
- **Authentication** — login, logout, SSO token exchange, failed attempts
- **Permission changes** — role grants, project membership updates, policy modifications
- **System configuration** — instance connections, environment settings, workspace policies

Data access entries also carry **per-column masking decisions**: which columns came back masked, which semantic type triggered it, and which rule matched.

Each entry carries the user's email, source IP, timestamp, operation duration, affected resource path, and request/response payloads. Sensitive fields (passwords, certificates, SSH keys, connection strings) are redacted automatically before the record is written.

A typical SQL execution record (with `request` and `response` shown decoded — on the wire they are JSON-encoded strings):

```json
{
	"name": "workspaces/-/auditLogs/12345",
	"createTime": "2026-05-05T14:23:11Z",
	"user": "users/alice@example.com",
	"method": "/bytebase.v1.SQLService/Query",
	"severity": "INFO",
	"resource": "instances/prod-postgres/databases/app",
	"request": {
		"name": "instances/prod-postgres/databases/app",
		"statement": "SELECT email, plan FROM users WHERE id = 12345",
		"limit": 1000
	},
	"response": {
		"results": [
			{
				"columnNames": ["email", "plan"],
				"columnTypeNames": ["TEXT", "TEXT"],
				"rowsCount": "1",
				"masked": [
					{
						"semanticTypeId": "bb.default.email",
						"semanticTypeTitle": "Email",
						"algorithm": "Range Mask",
						"context": "Matched global rule: PII Protection"
					},
					{}
				]
			}
		]
	},
	"status": { "code": 0 },
	"latency": "0.018s",
	"requestMetadata": {
		"callerIp": "10.0.5.42",
		"callerSuppliedUserAgent": "bytebase-web/3.x"
	}
}
```

The `masked` array is the differentiator. Engine-native auditing records that the SQL ran and returned a row. Bytebase records the per-column masking reason — `email` came back masked because it matched the `bb.default.email` semantic type under the global PII Protection rule. Non-masked columns appear as empty entries, preserving column-to-reason alignment. The shape is stable across SQL Editor queries, change rollouts, and data exports — one schema, every action.

## Getting Audit Data Out

Three export paths.

### GUI

Settings → Audit Log. Filter by user, method, resource, severity, and date range. Useful for spot checks and audit walkthroughs.

### API

Two endpoints, depending on scope:

- `/v1/auditLogs:search` — workspace-level, returns every audit record across projects
- `/v1/projects/{project}/auditLogs:search` — project-scoped

Both accept filter expressions on user, time range, method, severity, and resource. The response is structured JSON ready to ingest into any SIEM. Pagination via `pageToken`. Full schema and filter syntax are in the [API audit log tutorial](https://docs.bytebase.com/tutorials/api-audit-log).

### Log streaming

Settings → General → Audit Log Export. Bytebase writes audit records to stdout in addition to internal storage. Add the `--enable-json-logging` flag to the process to emit structured JSON. Any sidecar log shipper (Vector, Fluent Bit, the Datadog Agent, the Splunk Universal Forwarder) picks up stdout and forwards to the SIEM.

Use streaming for high-volume environments where API polling adds latency. Use the API for ad-hoc evidence pulls and scheduled exports.

## Pairing with Engine-Native Auditing

Bytebase audits SQL routed through Bytebase. Other paths bypass it:

- Direct connections from `psql`, `mysql`, or other clients
- Application traffic from production services connecting with their own credentials
- Emergency SSH access to the database host
- Replication and CDC pipelines reading the WAL or binlog

For full coverage, run Bytebase as the primary trail for human activity and keep engine-native auditing on as a backstop:

| Path                                | Captured by                                                       |
| ----------------------------------- | ----------------------------------------------------------------- |
| Human SQL through Bytebase          | Bytebase                                                          |
| Application service-account traffic | Engine-native (`pgaudit`, MySQL audit plugin, SQL Server Audit)   |
| Emergency direct access             | Engine-native + alerting on session source IP                     |
| Cloud infrastructure changes        | Provider audit logs (CloudTrail, Cloud Audit Logs, Azure Monitor) |

## Plan Availability

Audit logging is available on [Pro and Enterprise plans](https://www.bytebase.com/pricing/). Pro covers every event category, GUI and API access, and automatic redaction. Enterprise adds custom approval workflows and advanced access control, which generate additional audit events around policy enforcement.

For setup details and the latest field reference, see the [Bytebase audit log documentation](https://docs.bytebase.com/security/audit-log/).


Teams adopt Privileged Access Management (PAM) — CyberArk, BeyondTrust, [StrongDM](/blog/bytebase-vs-strongdm/), Teleport, HashiCorp Boundary — to solve the "who can SSH into which server" problem. The model works: vault credentials, broker connections, record sessions, enforce [just-in-time access](/blog/just-in-time-database-access/). Then they hit databases. The same tool gates the connection but stops being useful at the part that actually matters: what someone does once connected. The most common outcome is not a replacement decision — it's adding a database-native layer alongside PAM.

## Bytebase vs. PAM at a glance

The "PAM" column describes the typical posture across CyberArk, BeyondTrust, StrongDM, Teleport, and HashiCorp Boundary. See the [vendor landscape](#pam-vendor-landscape) for tool-specific notes.

| | PAM (typical) | Bytebase |
| --- | --- | --- |
| [Primary category](#what-pam-does-well) | Privileged access management for infrastructure | Database DevSecOps |
| [Infrastructure scope](#what-pam-does-well) | Servers, Kubernetes, cloud consoles, web apps, databases | Databases (30+ engines: PostgreSQL, MySQL, Oracle, SQL Server, MongoDB, etc.) |
| [Credential vaulting](#what-pam-does-well) | ✅ Infrastructure-wide (DBs, SSH, cloud, web) | ✅ For database credentials |
| [JIT database access](#where-pam-falls-short-for-databases) | ✅ Time-boxed connection access | ✅ Time-boxed access + per-query approval |
| [SQL review on the actual SQL](#where-pam-falls-short-for-databases) | ❌ | ✅ 200+ rules, checked before each statement runs |
| [Schema change workflow](#where-pam-falls-short-for-databases) | ❌ | ✅ Ticket-tracked rollout (dev → staging → prod) with rollback |
| [Per-query approval](#where-pam-falls-short-for-databases) | ❌ Approve the connection, not the query | ✅ Approve specific queries (e.g., DELETE on a large table) |
| [Audit log of executed SQL](#where-pam-falls-short-for-databases) | ⚠️ Session video replay | ✅ Searchable per-statement log (user, time, rows affected) |
| [Data masking](#where-pam-falls-short-for-databases) | ❌ | ✅ Per-column rules applied at query time (e.g., redact email) |
| [Web SQL editor with autocomplete](#where-pam-falls-short-for-databases) | ⚠️ Some (StrongDM, Teleport) | ✅ Built-in, with schema browser and query history |

## What PAM does well

PAM grew out of Unix administration. The mental model is "credentials are dangerous, so put them behind a broker," and every major vendor implements the same core capabilities:

- **Credential vaulting** — passwords, SSH keys, cloud tokens never live on developer laptops
- **JIT access broker** — request, approve, short-lived token, auto-revoke
- **Session recording** — keystrokes for SSH, network capture for DB protocols, screen capture for web consoles
- **Identity integration** — SSO, group-based policy, MFA enforcement
- **Connection-level audit** — who accessed what, when (not what they did)

For SSH into a Linux server, `kubectl exec` into a pod, or RDP into a Windows admin host, this is the right model. The high-value control is "did anyone unauthorized connect?" and PAM answers that question well.

## Where PAM falls short for databases

The same connection-level model that works for SSH falls apart on databases, because the high-value question shifts from "who connected?" to "what did they run?" Five concrete gaps show up in production:

### 1. No SQL review on the actual SQL being executed

PAM gates the connection. Once you're in, you can run anything the database role permits — including `DROP TABLE users;` or `UPDATE accounts SET balance = 0 WHERE customer_id = 12345;`. PAM records that you did it. It does not stop you, did not analyze the statement, and cannot tell whether the change is safe.

→ Bytebase parses every statement against [200+ rules](https://docs.bytebase.com/sql-review/review-rules/) before it runs: require a `WHERE` clause on large-table updates, block `SELECT`s on sensitive columns without masking, restrict schema changes to maintenance hours.

### 2. Schema change workflow is missing entirely

Database changes have a specific lifecycle: write the migration, review the SQL, run on dev, run on staging, run on production, with rollback ready. PAM has no concept of this. Schema migrations either get pasted into a brokered session (reviewed nowhere), or they go through a separate CI/CD pipeline that bypasses PAM entirely (no joined audit trail).

→ Bytebase issues track schema changes like Jira tickets — target databases, SQL, rollout sequence, approval chain, rollback script. Documented in [Change Workflow](https://docs.bytebase.com/change-database/change-workflow/).

### 3. Approval is connection-level, not statement-level

A common PAM policy reads: "Engineer Alice has JIT read access to `prod_db` for 4 hours, approved by Bob." Inside that window, Alice can run `SELECT * FROM customers WHERE 1=1` because the approval covers the *connection*, not the *statements*. The audit log shows "Alice connected with read access" — exactly what was permitted.

→ Bytebase moves approval to the statement layer: a SELECT against a sensitive table can require a separate per-query approver; a DELETE on a large table can be blocked or escalated.

### 4. Session recording is not the same as a structured audit log

A 30-minute database session in PAM produces a 30-minute video. To answer "who deleted rows from `orders` last Tuesday?" a compliance team has to find every session that touched `orders` and watch each recording. This is not what auditors mean by "audit log."

→ Bytebase logs each executed statement as a searchable row: user, timestamp, database, statement text, row count, duration. SOC 2 and PCI auditors accept this format directly — the same compliance question becomes a single SQL query against the audit table instead of hours of video review. See [Database Audit Logging](/blog/database-audit-logging/) for the compliance-driven design.

### 5. No native database idioms

Power users don't want a session-recorded SSH wrapper that proxies to `psql`. They want `psql` itself — autocomplete, schema browser, query history, the `\d` shortcuts they actually know. PAM brokers the raw protocol but the surface developers see is a stripped-down terminal or a generic SQL pad. The friction pushes power users toward shadow tools — a `bastion` host with `psql` bypassing PAM "for productivity."

→ Bytebase's web SQL Editor speaks the native protocol, with autocomplete from the live schema, per-user query history, saved queries, and result export — without a session-recording overlay between the developer and the database.

## The hybrid pattern (recommended for most teams)

```mermaid
flowchart TB
 Dev(["Developer"])
 Dev --> SSH["SSH to server"]
 Dev --> Kube["kubectl exec"]
 Dev --> DBQ["Database query"]

 SSH --> PAM1["PAM gate"]
 Kube --> PAM2["PAM gate"]
 DBQ --> BB["Bytebase gate"]

 PAM1 --> Server["Linux server"]
 PAM2 --> Pod["K8s pod"]
 BB --> Workflow["SQL review Approval policy Execute on DB Searchable audit log"]

 style BB fill:#e0f2fe,stroke:#0369a1
 style Workflow fill:#e0f2fe,stroke:#0369a1
```

PAM owns infrastructure-wide access. Bytebase owns the database step. Both authenticate against the same identity provider, so policy decisions reference the same user. The audit trail in PAM shows "Alice connected to db.prod-1 at 14:32"; the audit trail in Bytebase shows "Alice ran `UPDATE accounts SET status='frozen' WHERE id IN (...)` at 14:34, approved by Bob, affected 47 rows." Together they answer the full question.

This is the right setup if PAM is already deployed, database access volume is meaningful, compliance scope (SOC 2, ISO 27001, HIPAA, PCI) covers the database, or schema changes happen more than once a month.

## When one is enough

**PAM alone is enough** if database access is rare (a few queries a week, mostly DBAs), the schema is stable, auditors accept session recordings as evidence, and the database surface is low-risk (read-only analytics, no PII). Most companies under 20 engineers fit this profile.

**Bytebase alone is enough** if the stack is database-only — no servers, no Kubernetes admin, no cloud consoles to gate. Common at companies on managed databases (Supabase, Neon, RDS-only, PlanetScale, Aurora-only) where there's no underlying server to SSH into. As the infrastructure footprint grows, PAM gets added back for the non-database surface.

## PAM vendor landscape

Each major vendor's database story in one line:

| PAM Tool | Strength | Database gap |
| --- | --- | --- |
| **CyberArk** | Most mature enterprise credential vault; broadest compliance certifications | No database workflow layer; pricing is enterprise-only |
| **BeyondTrust** | DevOps Secrets Safe for CI/CD secret injection | Same connection-level model — no SQL review, no schema workflow |
| **StrongDM** | Modern UX, JIT-first design, strong web SQL pad | Detailed comparison: [Bytebase vs. StrongDM](/blog/bytebase-vs-strongdm/) |
| **Teleport** | Open-source friendly, k8s and SSH-native | Database access is a feature; SQL review and approval policy are not |
| **HashiCorp Boundary** | Open-source PAM, Terraform-native | Newer to the database story; less feature depth |

The pattern across all five: each does PAM well in its niche, but none reads the SQL or runs database-specific approval logic. That's not a criticism — those are different products.

## Which should you choose?

The framing usually has the wrong shape:

- **You probably need PAM** if you have any infrastructure surface — servers, Kubernetes, cloud admin consoles
- **You probably need Bytebase** if databases are a meaningful part of the access surface and someone will ask "what SQL ran?" in an audit
- **You probably want both** if both are true. The cost of running both is lower than the cost of either gap

The replacement framing only works at the edges: a database-only startup uses Bytebase without PAM; a database-rare team uses PAM without Bytebase. Everyone in the middle uses both.

## FAQ

**Is Bytebase a PAM tool?**
No. Bytebase is a database DevSecOps platform — schema change workflow, SQL review, access control, and audit log for databases specifically. PAM covers infrastructure-wide access (servers, Kubernetes, cloud consoles). The two overlap at JIT database access, but the broader categories differ.

**Can PAM tools manage database access?**
Yes, at the connection level — PAM brokers the connection, vaults the credential, and records the session. PAM does not read the SQL, approve individual queries, run schema change workflow, or produce a searchable log of every query that ran.

**Do I need both PAM and Bytebase?**
Most enterprise teams do. PAM owns infrastructure access (SSH, kubectl, cloud admin). Bytebase owns the database step (SQL review, approval policy, audit log). Both authenticate against the same identity provider, so the user experience is one login. See [Database Access Control Best Practices](/blog/database-access-control-best-practices/) for the broader design.

**How does Bytebase compare to StrongDM for database access?**
StrongDM is a PAM tool with a strong database story; Bytebase is database-native. The two are usually deployed together rather than against each other. Full breakdown: [Bytebase vs. StrongDM](/blog/bytebase-vs-strongdm/).

**Can Bytebase replace CyberArk for database access?**
For database-only access — yes, Bytebase can be the sole control plane. For server, Kubernetes, and cloud admin access — no, those need PAM. CyberArk is rarely removed from an enterprise that already has it.

**What's the difference between database PAM and database DevSecOps?**
Both vault database credentials and gate who can connect. The difference is scope above and below: PAM also vaults SSH keys, cloud tokens, and web-app credentials across the entire infrastructure; database DevSecOps adds SQL review, change workflow, [data access governance](/blog/data-access-governance/), and statement-level audit on top of the database connection. Different layers, and most production deployments use both.

**Does PAM cover SQL injection or DML risk?**
No. PAM logs the session that contained the SQL, but does not analyze the SQL itself. Static and policy-based SQL review (Bytebase) operates at a different layer — it parses each statement before execution and applies rules.


> Atlas is Terraform for databases. Bytebase is GitHub/GitLab for databases.

Both Bytebase and Atlas handle database schema migration. Atlas is a migration engine — you declare the desired schema state and it generates the SQL to get there. Bytebase is an all-in-one database DevSecOps platform — it covers the full lifecycle from migration review and deployment to access control, data masking, and audit logging. If your team spends too much time writing migration files, Atlas eliminates that step. If you need to manage who can change what, enforce review before deployment, mask sensitive data in query results, and keep an audit trail of every database operation — that's the problem Bytebase solves.

## How They Approach Schema Migration

**Atlas** (v1.1, February 2026) takes a declarative approach inspired by Terraform. You define your desired database schema in HCL, SQL, or import it from an ORM (16 ORMs supported across Go, Python, Node.js, Ruby, PHP, and Java). Run `atlas schema apply` and Atlas computes the diff between the current database state and your desired state, then generates and executes the migration. No manually written migration files needed — though Atlas also supports a versioned workflow where you generate migration files for review with `atlas migrate diff`.

**Bytebase** (v3.16, March 2026) primarily takes a workflow approach. Developers write SQL migration statements (or use schema sync to auto-generate them), submit them as change issues through a web GUI, and the system routes them through review, approval, and rollout. Bytebase also supports a [declarative state-based workflow](https://docs.bytebase.com/gitops/state-based-workflow/overview) for PostgreSQL — you commit the desired schema state to Git, and Bytebase generates the migration SQL automatically, similar to Atlas's approach. State-based support for other databases is on the roadmap.

Where does your team actually lose time? If developers keep writing bad migration SQL — wrong column type, missing index, forgotten constraint — Atlas catches that by generating the SQL for you. If the SQL itself is fine but it ships to production without review, or the wrong person runs it against the wrong database — Bytebase is built to stop that.

## What They Have in Common

- Schema diffing and sync — both can compare two database states and generate migration SQL.
- GitOps integration — both support Git-driven workflows where committed schema files trigger migrations.
- SQL linting — Atlas has 50+ safety analyzers; Bytebase has 200+ SQL review rules.
- Multi-database support — Atlas supports 16 engines; Bytebase supports 25.
- Open source with commercial tiers — Atlas CLI is Apache 2.0; Bytebase is MIT + Enterprise License (enterprise features).

## Key Differences Between Bytebase and Atlas

|                                | Atlas | Bytebase |
| ------------------------------ | ----- | -------- |
| [Migration approach](#migration-approach) | Declarative (HCL / SQL / ORM) | Imperative (SQL) + [state-based for PostgreSQL](https://docs.bytebase.com/gitops/state-based-workflow/overview) |
| [Developer interface](#developer-interface) | CLI; Cloud adds web dashboard | Web GUI + API + Terraform provider |
| [Supported databases](#supported-databases) | 16 (Starter tier: limited) | 23 |
| [ORM integration](#orm-integration) | 16 ORMs across 6 languages | — |
| [Migration linting](#migration-linting) | 50+ analyzers (local free; CI on Cloud Pro) | 200+ rules (all tiers) |
| [Batch change](#batch-change) | Rollout strategies; Cloud Pro adds canary | Built-in multi-env / multi-tenant |
| [Approval flow](#approval-flow) | Cloud Pro: ad-hoc approval | All tiers: manual rollout; Enterprise: custom multi-tier approval |
| [CI/CD integration](#cicd-integration) | GitHub Actions, Terraform, K8s operator; Cloud Pro adds managed CI | GitOps (GitHub, GitLab, Bitbucket, Azure DevOps) + API for any platform |
| [Access control & audit](#access-control-and-audit) | Cloud Pro: audit trails; Enterprise: SSO | All tiers: workspace/project roles; Pro: SSO, audit log; Enterprise: + dynamic data masking, just-in-time data access, custom roles |
| License | CLI: Apache 2.0 | MIT + commercial (Enterprise features) |

### Pricing Comparison

|  | Free | Mid-tier | Enterprise |
| --- | --- | --- | --- |
| **Atlas** | CLI (Apache 2.0, self-hosted, no limits) + Cloud Starter (limited DB support) | Cloud Pro: $9/dev/mo + $59/project/mo + $39/DB/mo | Custom (20+ DBs, SSO, air-gapped) |
| **Bytebase** | Community (self-hosted, up to 20 users, 10 instances) | Pro: $20/user/mo (cloud-only, up to 10 instances) | Custom yearly (self-hosted or cloud) |

### Migration Approach

**Atlas** uses a declarative model — you describe what you want the schema to look like, and Atlas plans how to get there. If you add a column to your HCL schema file, Atlas detects the difference and generates `ALTER TABLE ... ADD COLUMN` automatically. You never write migration SQL by hand unless you want to.

Atlas schemas can be defined in HCL:

```hcl
table "users" {
  schema = schema.public
  column "id" {
    type = int
  }
  column "name" {
    type = varchar(100)
  }
  primary_key {
    columns = [column.id]
  }
}
```

Or imported directly from your ORM — Atlas supports GORM, Ent, Django, SQLAlchemy, TypeORM, Sequelize, and 10 others. This means your application code is the source of truth for your schema, and Atlas generates migrations from it.

**Bytebase** primarily uses an imperative model — developers write the migration SQL themselves, submit it as an issue, get it reviewed, and deploy it. But Bytebase also supports a [state-based workflow](https://docs.bytebase.com/gitops/state-based-workflow/overview) for PostgreSQL: you commit the desired schema state to Git, and Bytebase generates the migration SQL automatically. It's the same idea as Atlas's declarative approach, though currently limited to Postgres. For other databases, Bytebase's schema sync can auto-generate diff SQL between two database states.

If your ORM already produces the SQL you need, Atlas's declarative approach is redundant — but Bytebase's review pipeline still applies. If you're a two-person team deploying your own changes, Bytebase's approval flow is overhead you don't need — but Atlas's auto-generated migrations save real time.

### Developer Interface

**Atlas** is CLI-first. You run `atlas schema inspect`, `atlas migrate diff`, `atlas schema apply` from the terminal. Atlas Cloud (paid) adds a web dashboard for monitoring deployments, viewing schema history, and running CI checks — but the core workflow stays in the CLI.

**Bytebase** is GUI-first. Developers create issues, DBAs review them, and the platform handles rollout — all through a web interface. It also exposes an [API](https://api.bytebase.com/), a [Terraform provider](https://docs.bytebase.com/integrations/terraform/overview), and [GitOps workflow tutorials](https://docs.bytebase.com/tutorials/gitops-github-workflow) for teams that prefer automation over clicking.

A team of developers who live in the terminal and deploy their own changes will find Atlas's CLI workflow faster. Once changes start passing through multiple hands — developer writes, lead reviews, DBA approves — you need that handoff to be visible and traceable, which is what Bytebase's GUI provides.

### Supported Databases

**Atlas** supports 16 databases: PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, ClickHouse, CockroachDB, TiDB, Oracle, Snowflake, Databricks, Spanner, Redshift, Aurora DSQL, and Azure Fabric. CockroachDB is supported both self-hosted and via CockroachDB Cloud. Several graduated from beta to GA in the v1.0 release (December 2025).

**Bytebase** supports 25 engines: 9 RDBMS (MySQL, PostgreSQL, Oracle, SQL Server, MariaDB, TiDB, OceanBase, CockroachDB, Spanner), 6 NoSQL (MongoDB, Redis, Cassandra, DocumentDB, DynamoDB, Cosmos DB), 9 data warehouses (Snowflake, BigQuery, Redshift, Hive, ClickHouse, Databricks, StarRocks, Doris, Trino), and Elasticsearch.

Atlas's declarative model handles 98%+ of each engine's DDL features — it goes deep on schema management. Bytebase covers more engine types (NoSQL, data warehouses) and adds features beyond migration: data masking, query control, access governance per engine.

### ORM Integration

Atlas integrates with 16 ORMs across 6 languages — GORM, Ent, Django, SQLAlchemy, Sequelize, TypeORM, Prisma, and others. It reads your ORM models directly and generates migrations without an intermediate schema file.

**Bytebase** doesn't integrate with ORMs for schema definition. It expects SQL input, whether hand-written or generated by your ORM's migration commands. If your team already uses Django's `makemigrations` or Rails' `db:migrate`, Bytebase fits into the pipeline after those tools generate SQL.

### Migration Linting

**Atlas** includes 50+ safety analyzers that catch destructive changes (dropping columns, tables), backward-incompatible modifications, data-dependent changes that might fail on large tables, and potential table locks. The open-source CLI runs these locally via `atlas migrate lint` for free. Atlas Cloud Pro adds managed CI integration — running lint checks automatically in GitHub Actions PRs.

**Bytebase** has 200+ [SQL review rules](https://docs.bytebase.com/sql-review/review-rules) that are database-engine-specific. Rules cover naming conventions, query patterns, schema design, and safety checks. You configure different error levels per environment — warn in dev, block in prod. Available in the free tier.

Atlas focuses on safety: will this migration break things? Destructive changes, lock risks, data-dependent failures. Bytebase checks safety too, but layers on team conventions — naming rules, query patterns, engine-specific best practices. You can fail a migration in Bytebase because a column name uses camelCase instead of snake_case.

### Batch Change

**Atlas** added deployment rollout strategies in v1.0 (December 2025). You can define staged rollouts with canary databases, parallelism limits, and error handling — useful for multi-tenant deployments where the same migration hits hundreds of databases.

**Bytebase** has had multi-environment and [multi-tenant batch changes](https://docs.bytebase.com/change-database/batch-change) since earlier versions. A single issue can deploy across dev, staging, and prod with gates between stages, or across hundreds of tenant databases with canary support.

Both handle fleet deployments. Atlas leans on code-defined rollout strategy — set it and let it run. Bytebase gives you a GUI where you watch it roll out in real time and can pause mid-deployment if something looks off.

### Approval Flow

**Atlas** open source has no approval workflow. **Atlas Cloud** supports ad-hoc approval workflows for declarative schema changes — someone can review and approve a migration plan before it's applied.

**Bytebase** Community and Pro include manual rollout — someone clicks "Deploy" to apply a change, which already prevents accidental or unauthorized execution. **Bytebase Enterprise** adds [custom approval flows](https://docs.bytebase.com/change-database/approval) on top: define rules like "DDL on prod needs DBA approval" or "changes touching 3+ databases need manager sign-off," and changes route through multi-tier approval automatically.

If the developer who writes the migration also applies it, you don't need an approval workflow — Atlas is fine. Once production changes require sign-off from someone other than the author, you need a system that enforces it, not a Slack message asking "can I deploy this?"

### CI/CD Integration

**Atlas** has native integrations with GitHub Actions, Terraform, Kubernetes (via an operator), GitLab CI, CircleCI, Azure DevOps, and ArgoCD. The GitHub Actions integration (`ariga/atlas-action`) is particularly mature — it lints migrations in PRs, applies them on merge, and supports approval workflows.

**Bytebase** offers [GitOps setup](https://docs.bytebase.com/gitops/overview) with GitHub, GitLab, Bitbucket, and Azure DevOps. SQL files committed to a repo create change issues in Bytebase automatically, with SQL review running as a merge check. For platforms without built-in integration, Bytebase's [API](https://api.bytebase.com/) lets you wire up any CI/CD pipeline — Jenkins, CircleCI, or your own scripts.

If your infrastructure is already Terraform-managed and your apps run on Kubernetes, Atlas slots right in — same declarative model, same toolchain. Bytebase takes a different angle: one place to see every database change across every environment, whether it's pending, in review, deploying, or done.

### Access Control and Audit

**Atlas** open source doesn't touch access control. **Atlas Cloud** adds audit trails and schema governance — you can see who applied what migration and when, but there's no role system or data masking.

**Bytebase** layers access control across its tiers:

- **Community** — [workspace and project roles](https://docs.bytebase.com/administration/roles) (Owner, DBA, Developer) with built-in permissions.
- **Pro** — adds SSO, [audit log](https://docs.bytebase.com/security/audit-log), and user groups.
- **Enterprise** — the full governance stack: [custom roles](https://docs.bytebase.com/administration/roles) with granular permissions, [dynamic data masking](https://docs.bytebase.com/security/data-masking/overview) at column level, Just-In-Time data access, enterprise SSO (OIDC, LDAP), and 2FA.

When your SOC 2 auditor asks "who approved this production change and when," Bytebase has the answer without stitching together logs from three different tools. Atlas Cloud records who ran the migration, but the approval chain, access control, and data masking live elsewhere in your stack.

### Pricing

**Atlas** has two tracks. The open-source CLI is Apache 2.0 — declarative migrations, versioned migrations, local linting, ORM integration, all free with no limits. Atlas Cloud adds CI/CD automation, drift detection, schema governance, and audit trails in three tiers: Starter (free, limited database support and inspection), Pro ($9/dev/month + $59/project/month + $39/month per additional database), and Enterprise (custom, 20+ databases, SSO, air-gapped deployment). The Pro costs add up — 5 developers with 1 CI project is $104/month before extra databases.

**Bytebase** has three tiers with different deployment models. Community is free, self-hosted, supports up to 20 users and 10 database instances — includes the full GUI, SQL review (200+ rules), GitOps, and multi-environment rollouts. Pro is $20/user/month, cloud-only, up to 10 database instances, and adds SSO, audit log, and user groups. Enterprise is custom pricing (yearly), available self-hosted or cloud, and adds custom approval workflows, dynamic data masking, OIDC/LDAP SSO, custom roles, audit logging, SCIM, and 2FA. [Full pricing details](https://www.bytebase.com/pricing/).

The pricing models reflect different philosophies. Atlas charges per developer, per project, and per database — costs scale with infrastructure complexity. Bytebase charges per user — costs scale with team size. A 5-person team managing 1 project with 3 databases pays Atlas $221/month; the same team on Bytebase Pro pays $100/month flat.

## When to Choose Atlas

- Your team writes schema definitions in code (HCL or ORM models) and wants automatic migration generation.
- You prefer managing database schemas with the same declarative, infrastructure-as-code pattern you use for application deployments.
- Your workflow is developer-driven — whoever writes the code also manages the database, without a separate DBA review step.
- You want the Apache 2.0 CLI without vendor lock-in for the core migration engine.

## When to Choose Bytebase

- You want an all-in-one platform that covers migration, SQL review, access control, data masking, and audit logging — not just migration execution.
- Your team has a separation between developers who write changes and DBAs/platform engineers who review and deploy them.
- You need compliance — approval flows, audit trails, and data masking for SOC 2, GDPR, or internal security policies.
- You want a single web interface where all database changes are visible, reviewable, and traceable across environments.

## FAQ

### Can I use Atlas and Bytebase together?

Yes. Use Atlas to generate migration SQL from your HCL or ORM models, then submit that SQL through Bytebase for review and controlled rollout. Atlas handles "what changes"; Bytebase handles "who approves and how it ships." Some teams actually run both — Atlas for the migration engine, Bytebase for the governance layer.

### Atlas is declarative — does that mean it's always better than writing SQL?

For adding tables and columns, yes — you describe the end state and Atlas figures out the ALTER statements. Bytebase offers the same declarative approach for PostgreSQL via its [state-based workflow](https://docs.bytebase.com/gitops/state-based-workflow/overview), though Atlas supports it across all 16 of its database engines. Declarative breaks down with data migrations: moving data between columns, backfilling defaults, splitting tables. That requires imperative SQL that understands the data, not just the schema shape. Even Atlas-heavy teams write hand-crafted migrations for those.

### Which tool has better CI/CD integration?

Depends on your stack. Atlas has a Kubernetes operator and Terraform provider, so if you're already managing infrastructure declaratively, database schemas fit the same pipeline. Bytebase has tighter GitHub/GitLab integration — commit a SQL file and it becomes a reviewable change issue with linting results inline. Pick whichever matches how your team already ships.

### Is Bytebase Community actually usable for production?

Yes. Community includes the full web GUI, 200+ SQL review rules, GitOps integration, multi-environment rollouts, and batch changes — the same core workflow as paid tiers, not a stripped-down demo. The limits are 20 users and 10 database instances. What you don't get is SSO, audit log (Pro), or custom approval flows, data masking, and custom roles (Enterprise). Plenty of teams run Community in production and only upgrade when they need compliance features.

### Is Atlas really free?

The CLI is fully free under Apache 2.0 — declarative migrations, versioned migrations, local linting, ORM integration, no limits. Atlas Cloud is a separate product: Starter (free, limited database support), Pro ($9/dev/month + $59/project/month + $39/DB/month for CI/CD, drift detection, governance), and Enterprise (custom pricing, SSO, air-gapped deployment). The CLI alone covers most solo/small-team needs; you hit Cloud when you want managed CI runs or monitoring.

---

Related comparisons:

- [Bytebase vs. Liquibase](/blog/bytebase-vs-liquibase/)
- [Bytebase vs. Flyway](/blog/bytebase-vs-flyway/)
- [Flyway vs. Liquibase](/blog/flyway-vs-liquibase/)
- [Top Database Schema Change Tools](/blog/top-database-schema-change-tool-evolution/)
- [Database Version Control](/blog/database-version-control/)


Bytebase ブログ

Notes on the MySQL 9.7 LTS release

PostgreSQL 19 features I'm excited about

HIPAA Compliance

データベース開発のスタンダードを体験する

ソリューションとプラットフォーム

比較

法的事項

リソース

会社

ソリューションとプラットフォーム

リソース

比較

会社

法的事項