# Governed MySQL access for AI agents

> Give AI agents governed access to MySQL 8.0 and 8.4: verified TLS, direct read-only grants per role, customer-owned views for restrictions, no agent SQL.

Canonical URL: https://sembric.app.arelis.digital/integrations/mysql

Integration · MySQL 8.0 and 8.4

Connect a MySQL 8.0 or 8.4 database over mandatory verified TLS with direct read-only grants per Sembric role.

Identity

## How Sembric connects to MySQL

### Per-role identity

Each Sembric role uses a distinct serving-only login over mandatory verified TLS. An operator allowlists the exact host, port and database.

### Your policies stay in force

Customer-owned views and column grants enforce restrictions. MySQL has no native row policies like PostgreSQL’s, and Sembric does not claim them.

Enforcement

## What Sembric checks and refuses

-   Before any data SQL, Sembric refuses write, administrative, global or foreign-database grants, proxy and role grants, and grant options; only direct SELECT and SHOW VIEW grants are supported.
-   Reads use read-only transactions and binary prepared parameters.
-   Native types, enum and set labels and collations enter the reviewed fingerprint, so a change withdraws access.
-   MariaDB and versions outside 8.0 and 8.4 are refused.

Limits

## What these controls don’t do

-   Server execution settings and client deadlines stop release after limits, but do not cap source scan cost or guarantee immediate cancellation.

Setup

## Connecting MySQL

1.  Create a login per Sembric role with direct SELECT (and SHOW VIEW where needed) on approved tables, views or columns only.
2.  Use customer-owned views to express row restrictions, and verify them under each login.
3.  Have an operator allowlist the exact endpoint and provision each password as a runtime secret; an owner then tests every mapping.
4.  Discover, review classifications and certify with an independent reviewer.

FAQ

## MySQL questions

### How do we restrict rows in MySQL?

Use customer-owned views and column grants for each role’s login. Certification runs its checks under every granted login, so a view that changes answers per role is visible during review.

### Is MariaDB supported?

Not yet. Sembric supports MySQL 8.0 and 8.4 and refuses other engines until they have their own acceptance work.

## Other integrations

-   [BigQuery](https://sembric.app.arelis.digital/integrations/bigquery)
-   [Snowflake](https://sembric.app.arelis.digital/integrations/snowflake)
-   [Trino](https://sembric.app.arelis.digital/integrations/trino)
-   [Databricks](https://sembric.app.arelis.digital/integrations/databricks)
-   [PostgreSQL](https://sembric.app.arelis.digital/integrations/postgresql)

## Put your first certified data product in front of an agent.

Tell us which warehouse you run and what your agents need to answer. We will help you connect a source, certify a first surface and query it over MCP.

[Request a pilot](https://sembric.app.arelis.digital/contact) · [Email us](mailto:contact@arelis.digital?subject=Sembric%20pilot%20request)

---

Last updated 2026-10-14. Published by Arelis AI (https://arelis.digital).