Per-role identity
Each Sembric role uses a distinct serving-only login over mandatory verified TLS. An operator allowlists the exact host, port and database.
Integration · MySQL 8.0 and 8.4
Governed MySQL access for AI agents
Connect a MySQL 8.0 or 8.4 database over mandatory verified TLS with direct read-only grants per Sembric role.
Identity
How Sembric connects to MySQL
Your policies stay in force
Customer-owned views and column grants enforce restrictions. MySQL has no native row policies like PostgreSQL’s, and Sembric does not claim them.
Enforcement
What Sembric checks and refuses
- Before any data SQL, Sembric refuses write, administrative, global or foreign-database grants, proxy and role grants, and grant options; only direct SELECT and SHOW VIEW grants are supported.
- Reads use read-only transactions and binary prepared parameters.
- Native types, enum and set labels and collations enter the reviewed fingerprint, so a change withdraws access.
- MariaDB and versions outside 8.0 and 8.4 are refused.
Limits
What these controls don’t do
- Server execution settings and client deadlines stop release after limits, but do not cap source scan cost or guarantee immediate cancellation.
Setup
Connecting MySQL
- Create a login per Sembric role with direct SELECT (and SHOW VIEW where needed) on approved tables, views or columns only.
- Use customer-owned views to express row restrictions, and verify them under each login.
- Have an operator allowlist the exact endpoint and provision each password as a runtime secret; an owner then tests every mapping.
- Discover, review classifications and certify with an independent reviewer.
FAQ
MySQL questions
How do we restrict rows in MySQL?
Use customer-owned views and column grants for each role’s login. Certification runs its checks under every granted login, so a view that changes answers per role is visible during review.
Is MariaDB supported?
Not yet. Sembric supports MySQL 8.0 and 8.4 and refuses other engines until they have their own acceptance work.
Other integrations
Put your first certified data product in front of an agent.
Tell us which warehouse you run and what your agents need to answer. We will help you connect a source, certify a first surface and query it over MCP.