# Sembric: full site text --- --- > Sembric is a governed data layer between customer-owned warehouses or lakehouses and AI agents. It discovers existing tables and views, lets your team classify fields and certify aggregate data products or governed views, and exposes only those certified surfaces to agents through a typed API and MCP. --- --- # Give AI agents certified answers, not warehouse access. > Sembric sits between your warehouse and your AI agents. Classify fields, certify aggregates and views, and let agents query only certified data over MCP. Canonical URL: https://sembric.app.arelis.digital/ The governed data layer for AI agents Sembric sits between the warehouse you already run and the agents your teams are building. Your people classify fields and certify the exact aggregates and views agents may use. Agents query only those certified surfaces through MCP or a typed API, with no SQL, no copied data and an audit record for every call. [Request a pilot](https://sembric.app.arelis.digital/contact) · [See how it works](https://sembric.app.arelis.digital/product) Works with [BigQuery](https://sembric.app.arelis.digital/integrations/bigquery), [Snowflake](https://sembric.app.arelis.digital/integrations/snowflake), [Trino](https://sembric.app.arelis.digital/integrations/trino), [Databricks](https://sembric.app.arelis.digital/integrations/databricks), [PostgreSQL](https://sembric.app.arelis.digital/integrations/postgresql) and [MySQL](https://sembric.app.arelis.digital/integrations/mysql). Illustrative example with synthetic names. Agents reach only certified surfaces granted to their role; sensitive fields and SQL never pass through. The problem ## Every company wants agents on its data. Today’s shortcuts put the data at risk. Teams are under pressure to connect AI agents to business data. The fastest paths hand an agent far more than the answer it needs, and leave nobody accountable for what it says. - ### Credentials and raw SQL The quickest integration hands an agent a service account and lets the model write queries. That account can read every table it can see, and nobody reviewed the query it just ran. - ### Copies that drift Exporting tables into a new store for agents creates one more copy to secure. Warehouse policies do not follow the data, and the numbers start to disagree with the source. - ### Answers nobody vouches for A model that writes its own joins can return a confident, wrong figure. There is no business definition, owner or check behind it, and no way to tell a good answer from a lucky one. - ### No record and no limits When an answer is questioned, teams cannot say which agent asked what, under which identity, or what it was refused. Nothing bounds how much an agent can ask the warehouse for. How Sembric works ## A governed path from table to agent, in four steps Sembric does not add another copy of your data. It adds review, certification and enforcement between the data you already govern and the agents that need answers. 1. 01 · Discover ### Connect what you already run An owner connects a warehouse with a read-only customer identity per Sembric role. Sembric reads the catalog of existing tables and views. It never ingests, copies or transforms rows. 2. 02 · Classify ### Review every field Columns that look personal start sensitive. The asset’s data steward reviews its classification before anything is published, and sensitive fields can never become measures, dimensions or view columns. 3. 03 · Certify ### Prove the answer first Define an aggregate data product or a governed view with business context. A reviewer who is neither its owner nor its last editor runs expected-answer checks under every granted role, then certifies it for 30 days. 4. 04 · Serve ### Agents query only that Agents discover and query certified surfaces through MCP or the typed API: declared fields, typed filters and bounded limits. Every call is audited, answered or refused. [Read the full workflow](https://sembric.app.arelis.digital/product) What an agent sees ## Answers when it’s certified. Refusals when it isn’t. Agents get typed tools, business definitions and caveats, never a connection string. Anything outside a certified surface is refused before a source query runs, and recorded. ``` → tools/call sembric_query_product { "productId": "net-revenue-by-region", "dimensions": ["region", "ordered_at:quarter"], "filters": { "ordered_at": { "gte": "2026-01-01", "lt": "2026-07-01" } }, "limit": 20 } ← 4 rows · certified · expires in 23 days region ordered_at net_revenue North 2026-01-01 412880.00 North 2026-04-01 436120.00 South 2026-01-01 298410.00 South 2026-04-01 305990.00 audit answered · caller mcp · key 3f9c…a1 ``` ``` → tools/call sembric_query_product { "productId": "net-revenue-by-region", "dimensions": ["customer_email"], "limit": 20 } ← refused before any source query customer_email is not a declared dimension of this product. audit refused · undeclared field · caller mcp · key 3f9c…a1 ``` ``` steward customers.segment marked sensitive → classification changed sembric certificate withdrawn · product returned to draft → agent visibility removed in the same transaction → tools/call sembric_list_products ← net-revenue-by-segment is no longer listed audit certificate withdrawn · notification sent ``` Illustrative synthetic data. Tool names match Sembric’s MCP server. ### Agents can - List the certified products and views granted to their role - Group by up to three declared dimensions, including day to year time grains - Filter with typed equality, value lists of up to 50, and ranges on numeric, date and time fields - Read definitions, caveats and the concepts a surface grounds ### Agents cannot - Send SQL or reach source credentials - See undeclared, sensitive or nested fields - Query drafts, expired or withdrawn surfaces - Release groups smaller than a product’s reviewed minimum Shortcut vs. Sembric ## The difference between access and a governed answer Connecting agents directly compared with connecting them through Sembric | Concern | Direct agent access | Through Sembric | | --- | --- | --- | | Access | A shared service account that can read whatever it can see | Certified surfaces granted to the caller’s current role | | Interface | Free-form SQL written by the model | Typed tools over declared fields, filters and limits | | Data movement | Exports and copies into new stores | Data stays in your warehouse or lakehouse | | Correctness | Model-written joins with no review | Business definitions with independent expected-answer checks | | Change | Schema and policy changes go unnoticed | Drift or reclassification withdraws access automatically | | Accountability | Little or no record of agent activity | Every agent query audited, answered or refused | | Load | Nothing bounds what an agent asks for | Persistent workspace read budgets before every statement | Certification ## At least two people stand behind every certified answer The person who defines a surface can’t certify it. An independent reviewer runs distinct expected-answer checks under each granted role’s own source identity, so row policies that change answers per role are caught during review. Data product Net revenue by region Certified Measure sum(net\_amount) Granted roles analyst, viewer Minimum group 5 records Expires in 23 days Expected-answer checks run under each granted role | Check under role | Expected | Result | | --- | --- | --- | | Analyst · Q1 total | 711,290.00 | pass | | Analyst · North only | 849,000.00 | pass | | Viewer · Q1 total | 412,880.00 | pass | | Viewer · North only | 849,000.00 | pass | Reviewer is neither the owner nor the last editor · fingerprint unchanged through the final check - Classification review by the asset’s assigned data steward comes first - The reviewer must differ from both the current owner and the last definition editor - Each granted role needs distinct checks; a check can override its expected answer per role - Governed views also prove every granted identity can read the approved projection - The reviewed asset fingerprint must stay unchanged through the final check [See the security model](https://sembric.app.arelis.digital/security) Safe by default ## When something changes, access stops Governance that only holds on the day of review isn’t governance. Sembric withdraws access as soon as the facts behind a certificate change. - ### Schema drift stops queries Before each query Sembric compares the live schema with the certified fingerprint. A mismatch stops the query until the source is rediscovered, reviewed and recertified. - ### Reclassification withdraws Mark a column sensitive and every product or view that uses it returns to draft. Re-reviewing cannot quietly recertify an unchanged draft. - ### Revocation is immediate Membership, role, the calling key and the certificate are rechecked after every source query, so a revocation mid-query withholds the rows. - ### Certificates expire Certificates last 30 days by default. Renewal in the final week re-runs every check; an expired surface returns to draft with an audit record. - ### Source edits reset trust Editing or pausing a source withdraws dependent reviews and certificates in one transaction. Resuming requires rediscovery and recertification. - ### Budgets before contact Every statement reserves workspace minute and day read budgets before reaching the source, and BigQuery jobs reserve a daily billed-byte allowance. Your warehouse stays in charge ## Built on the engines and policies you already trust Sembric queries with the customer identity mapped to each Sembric role, so the source engine’s own row and column policies keep applying. Only owners connect sources or change those mappings. - Google Cloud data warehouse ### [BigQuery](https://sembric.app.arelis.digital/integrations/bigquery) Discover a BigQuery dataset and serve certified aggregates and governed views to agents, with each Sembric role impersonating its own customer service account. - Cloud data platform ### [Snowflake](https://sembric.app.arelis.digital/integrations/snowflake) Connect a Snowflake schema over the SQL API with one key-pair user and role per Sembric role, and let agents query only certified surfaces. - Federated SQL engine and lakehouse catalogs ### [Trino](https://sembric.app.arelis.digital/integrations/trino) Discover one Trino catalog and schema, including a lakehouse catalog you operate, and serve certified surfaces through role-specific read-only users. - Databricks SQL warehouse with Unity Catalog ### [Databricks](https://sembric.app.arelis.digital/integrations/databricks) Connect a Databricks SQL warehouse and one Unity Catalog schema with a separate OAuth service principal per Sembric role. - Native PostgreSQL ### [PostgreSQL](https://sembric.app.arelis.digital/integrations/postgresql) Connect an existing PostgreSQL schema over verified TLS with a restricted login per Sembric role, keeping row-level security in force. - MySQL 8.0 and 8.4 ### [MySQL](https://sembric.app.arelis.digital/integrations/mysql) Connect a MySQL 8.0 or 8.4 database over mandatory verified TLS with direct read-only grants per Sembric role. Built for agents ## One MCP endpoint. Eight read-only tools. Connect Claude Code or any HTTP MCP client with a short-lived, revocable Sembric key, or with user-linked tokens from your identity provider. Applications that don’t speak MCP use the typed REST API, described by an OpenAPI document. [Connect an agent](https://sembric.app.arelis.digital/agents) FAQ ## Frequently asked questions ### Does Sembric copy or move our data? No. Customer data stays in its source. Sembric stores metadata, definitions, classifications, checks, certificate state and audit records, and runs bounded, parameterized reads in your engine when a certified surface is queried. ### Can an agent run its own SQL through Sembric? No. No agent route accepts SQL. Agents choose from declared dimensions, typed filters and a bounded limit on surfaces certified for their role, and Sembric builds the source query. ### How is this different from giving an agent a read-only service account? A read-only account can still read every table it can see and lets the model write any query. Sembric narrows that to reviewed fields and certified definitions, checks the answers before release, rechecks access after every source query, and audits each call — answered or refused. ### Which agents can use Sembric? Any client that speaks the Model Context Protocol over HTTP, such as Claude Code, plus applications that call the typed REST API. Agents authenticate with a short-lived, revocable Sembric key or a user-linked token from your identity provider. ### What happens when a table’s schema changes? Before every query Sembric compares the live schema with the certified fingerprint. A mismatch stops the query until the source is rediscovered, reviewed and recertified. ### Is Sembric generally available? Sembric is available for pilots. Its commercial release depends on acceptance gates that are still open, and we share the current evidence with pilot customers. ## Put your first certified data product in front of an agent. Tell us which warehouse you run and what your agents need to answer. We will help you connect a source, certify a first surface and query it over MCP. [Request a pilot](https://sembric.app.arelis.digital/contact) · [Email us](mailto:contact@arelis.digital?subject=Sembric%20pilot%20request) --- Last updated 2026-10-14. Published by Arelis AI (https://arelis.digital). --- # How Sembric turns warehouse tables into answers agents can trust > The Sembric workflow: discover existing tables, steward field classification, certify data products and governed views independently, then enforce every query. Canonical URL: https://sembric.app.arelis.digital/product Product Sembric runs one governed workflow: discover what you already have, classify it, certify exactly what agents may use, then enforce that on every call. Here is each step and the rules it enforces. 1 · Discover ## Read the catalog, never the whole warehouse An owner connects a BigQuery dataset, Snowflake schema, Trino catalog and schema, Databricks catalog and schema, PostgreSQL schema or MySQL database, and tests the customer identity each Sembric role uses before saving. - Discovery reads every catalog page before publishing the refreshed inventory, so a failure part-way leaves the previous catalog intact. - Assets that disappear are marked missing, lose their reviews and dependent certificates, and cannot be used until restored and rediscovered. - Readable display names can be set per workspace; the physical relation stays visible for traceability and remains the only query target. - Owners and engineers browse the catalog; analysts and viewers see only certified surfaces, because table and column names can be sensitive themselves. 2 · Classify and steward ## Every asset has one accountable steward Columns with common personal-data names start sensitive. That heuristic is a starting point, so review by the asset’s assigned data steward is mandatory before anything built on it can be certified. - An owner assigns a steward, or the first eligible reviewer claims an unassigned asset. Reassignment withdraws the review and dependent certificates atomically. - Engineers can mark a column sensitive; only an owner can clear the mark. Many columns can be marked in one reviewed change. - Nested or repeated fields keep their full type in the reviewed fingerprint, start sensitive when any nested name looks personal, and cannot be measures or dimensions. - Every preview, certification and query rechecks the stored definition against the current classification, so a newly sensitive column can never be released. 3 · Define ## Two kinds of certified surface Both carry a business definition, caveats, concepts, role grants and at least two distinct expected-answer cases. Every saved definition is versioned with a field-level history. Aggregate ### Data product One measure — `sum`, `count`, `count_distinct`, `avg`, `min` or `max` — over approved dimensions. Sum, average, minimum and maximum need a numeric measure so their checks are verifiable. A reviewed minimum group size is enforced in the source query with `HAVING COUNT(*) >= n` for previews, certification, the API and MCP. It withholds small groups but is not complementary suppression, so keep person-level dimensions coarse. Projection ### Governed view Approved, non-sensitive columns with optional fixed row restrictions. Restrictions are equality or value lists, never open ranges, and are always conjoined with what the caller asks for. Certification also proves that each granted source identity can actually read the approved projection — a row count alone cannot prove column access. 4 · Certify ## Independent review, checked under every role A builder requests review from a named, independent owner or engineer. The request closes itself when the surface is certified or its definition changes. Data product Net revenue by region Certified Measure sum(net\_amount) Granted roles analyst, viewer Minimum group 5 records Expires in 23 days Expected-answer checks run under each granted role | Check under role | Expected | Result | | --- | --- | --- | | Analyst · Q1 total | 711,290.00 | pass | | Analyst · North only | 849,000.00 | pass | | Viewer · Q1 total | 412,880.00 | pass | | Viewer · North only | 849,000.00 | pass | Reviewer is neither the owner nor the last editor · fingerprint unchanged through the final check - The reviewer differs from both the current owner and the last definition editor. - Each granted role runs two distinct checks; an expected answer can be overridden per role when source row policies differ. - COUNT checks need exact non-negative integers; SUM and AVG allow only machine-precision noise. - A failed or refused certification is recorded with its reason and visible to every builder. - Certificates last 30 days by default. In the final 7 days an independent reviewer can renew in place by re-running every check; expired certificates are never renewed. 5 · Serve ## Bounded, typed queries — and nothing else Agents and applications query certified surfaces through MCP or the REST API. Sembric builds the source query; callers supply only these inputs. Query rules enforced for every API and MCP call | Rule | What Sembric enforces | | --- | --- | | Fields | Only declared dimensions or approved columns; a product query may group by at most three of up to 12 declared dimensions. | | Filters | Equality, a value list of at most 50, or a range on numeric, date and time fields — always bound as typed parameters. | | Time grains | day, week, month, quarter or year on declared date or timestamp dimensions; weeks start Monday and instants bucket in UTC. | | Limits | 1 to 100 rows. A query matching more is refused with narrowing guidance instead of being truncated. | | Result shape | Provider rows must have exactly the approved columns; an extra or missing field fails closed. | | Response size | Serialized rows are capped at 1 MB by default (configurable up to 4 MB) before release. | | Fixed restrictions | A view’s equality or value-list restrictions are always conjoined with caller filters and cannot be replaced. | After a source query returns, Sembric rechecks membership, role, the calling session or key, and the certificate before releasing rows. Context for agents ## Ontology and lineage Concepts declared on certified surfaces form a shared ontology. Owners and engineers connect them with typed relationships, and certification refuses a conflicting definition for an existing concept. - The API and MCP filter concepts and relationships to the surfaces visible to the caller; links disappear when a surface is withdrawn. - Column-level lineage traces each certified surface from its source columns — sensitive ones shown as withheld — through approved fields to concepts, roles and agents. - Cmd/Ctrl+K searches everything a member may see. Workspace ## Roles, collaboration and monitoring Membership and role are re-read on every request, so changes take effect immediately for people and their agents. Workspace roles | Role | Can | | --- | --- | | Owner | Connects sources and maps role identities, assigns stewards, invites and removes members, clears sensitive marks, revokes any key. | | Engineer | Browses the catalog, rediscovers sources, marks columns sensitive, builds and certifies surfaces, monitors agents. | | Analyst | Sees and queries the certified products and views granted to the analyst role. | | Viewer | Sees and queries the certified products and views granted to the viewer role. | - Notifications cover review requests, certification outcomes, withdrawals, renewals due and expiry — in-app, with optional email and webhook copies that carry only a title and a portal link. - The Agents page shows answered and refused calls, the busiest surfaces, recent refusals and each key’s last use. - Owners download workspace audit events as JSONL from the Activity page. FAQ ## Frequently asked questions ### What is the difference between a data product and a governed view? A data product is one aggregate measure — sum, count, distinct count, average, minimum or maximum — over approved dimensions. A governed view projects approved columns with optional fixed row restrictions. Both carry business context, role grants and expected-answer checks. ### Who can certify a surface? An owner or engineer who is neither the surface’s current owner nor its last definition editor. They run two distinct expected-answer checks under every granted role’s source identity before certifying. ### How long does a certificate last? Thirty days by default. In the last seven days an independent reviewer can renew it by re-running every check. An expired certificate is withdrawn, recorded and never renewed; the surface returns to draft. ### How do aggregates protect people in small groups? A product can set a reviewed minimum group size, enforced in the source query with HAVING COUNT(\*) >= n. It withholds small groups but is not complementary suppression, so keep person-level dimensions coarse. ## Put your first certified data product in front of an agent. Tell us which warehouse you run and what your agents need to answer. We will help you connect a source, certify a first surface and query it over MCP. [Request a pilot](https://sembric.app.arelis.digital/contact) · [Email us](mailto:contact@arelis.digital?subject=Sembric%20pilot%20request) --- Last updated 2026-10-14. Published by Arelis AI (https://arelis.digital). --- # A security model built around your source, not around trust in the agent > How Sembric protects warehouse data from AI agents: per-role source identities, no SQL, fail-closed checks, revocable keys, full audit and honest cost limits. Canonical URL: https://sembric.app.arelis.digital/security Security Sembric assumes agents will ask for things they shouldn’t. It answers only from reviewed, certified definitions, keeps your warehouse in charge of row and column access, and records every decision. Principles ## Six rules Sembric does not bend - ### Data stays in its source Sembric stores metadata, definitions, classifications, checks, certificate state and audit records. Source rows are read by bounded queries in your engine and never copied into Sembric. - ### Your engine stays authoritative Queries run as the customer identity mapped to the acting Sembric role, so source row and column policies keep applying. Sembric only narrows access further. - ### No SQL from agents No agent route accepts SQL. Query builders accept declared fields only, bind every value as a typed parameter and enforce bounded limits. - ### Fail closed Schema drift, reclassification, an extra or missing result column, an oversized response or a stale source version stops the release rather than passing it on. - ### Revocable credentials Agent keys are random, stored as digests, shown once, expire within 90 days and can be revoked immediately. Members’ roles are re-read on every request. - ### Everything recorded Every agent query is audited, answered or refused, with a caller naming its channel and the public key identifier. Session tokens and their hashes are never recorded. Identity and access ## People, agents and source identities stay separate ### People - Portal single sign-on through your OIDC provider with authorization code and PKCE; a configured hosted domain is checked in the signed token. - Browser sessions are random tokens stored as SHA-256 digests in HttpOnly, SameSite=Strict cookies and expire after eight hours. - Removing a member deletes their sessions and revokes their API keys in the same transaction. ### Agents - Short-lived Sembric keys with one-, seven- or 30-day lifetimes, inheriting the issuing member’s current role. - Optional OIDC access tokens must be signed by the configured issuer, target the exact /mcp resource, carry sembric:read and map to one verified member. - Owners can revoke any member’s key; engineers monitor agents but revoke only their own keys. ### Sources - Only owners connect sources, test role identities or change mappings; engineers may rediscover. - Each Sembric role maps to a distinct, narrow customer identity; connectors refuse administrative, write and ownership privileges they can detect. - Source secrets are runtime-only references. The portal shows names of references, never values, and agents never see either. Query safety ## What happens on every agent query Each step runs on every call to the API or MCP, for every connector. 1. **Authenticate and authorize.** Resolve the key or token to a current member and role; refuse ungranted or uncertified surfaces and audit the refusal. 2. **Validate against the definition.** Accept only declared fields, typed filters and a bounded limit, and recheck the definition against the current classification. 3. **Reserve budget.** Atomically reserve the live schema check and the data statement against the workspace minute and day budgets; a refusal at this boundary consumes nothing and contacts no source. 4. **Check the live schema.** Compare it with the certified fingerprint and stop on any drift. 5. **Run a parameterized read.** Execute under the role’s source identity with the source’s own policies, deadlines and response bounds. 6. **Verify the result.** Release rows only if their keys exactly match the approved shape and the serialized size stays within the cap. 7. **Recheck access.** Re-read membership, role, the calling credential and the certificate before returning rows, then record the outcome. Privacy in aggregates ## Small groups, handled honestly A data product can set a reviewed minimum group size. The source query adds HAVING COUNT(\*) >= n, so smaller groups — and filters that would isolate them — return no row in previews, certification, the API and MCP. Threshold suppression is not complementary suppression. When a released total and the other released groups differ by exactly one withheld group, a caller could derive it by subtraction. For person-level data, keep dimensions coarse or don’t grant the product to roles that should never see small groups. Audit and operations ## Evidence you can hand to an auditor - Audit records cover source connection and discovery, classification, product changes, certification and failed checks, expiry, keys, invitations and every product and view query. - In the isolated Cloud SQL runtime, committed audit events are archived to create-only objects in a bucket in a separate backup project with a locked retention policy; the runtime cannot delete objects or administer the bucket. - Owners export workspace-scoped audit events as JSONL, one date range of up to 31 days at a time. - Notifications and outbox rows carry a title and a portal link only — never check details, source values, credentials or invitation links. - The runtime logs the request path only: never query strings, cookies, tokens, keys or source rows. Cost controls ## Bounded by design, honest about the limits Every statement submitted to a source consumes persistent workspace read budgets before contact — 120 per minute and 5,000 per UTC day by default — including previews, certification checks, catalog pages and schema reads. - BigQuery jobs also reserve a workspace UTC-day billed-byte allowance before job creation, capped by the source’s per-query maximumBytesBilled. - Snowflake, Databricks, PostgreSQL and MySQL apply statement timeouts and bounded responses; Trino sets coordinator-side run-time and physical-scan settings. These are on-demand query controls, not invoice limits. They do not cap warehouse credits, DBUs, capacity pricing or storage. Keep your own project budgets, quotas and billing alerts. Deployment ## Isolation per customer Sembric’s commercial deployment design gives each customer its own Google Cloud workload project, a separate backup project and its own Cloud SQL instance, with the serving and migration identities kept apart. - Serving traffic leaves through a customer-specific NAT address that public sources can allowlist. It is a stable address, not a destination firewall. - Cloud Armor applies a strict sign-in throttle and a configurable per-client edge limit. - Local DuckDB files are pilot-only and are disabled at startup in the isolated customer runtime. ### What we don’t claim yet Sembric is available for pilots. Its commercial acceptance gates — including a second-plane cross-tenant test, Cloud SQL failover, customer-scale load and recurring archive-integrity verification — are still open, and Sembric holds no third-party security certification today. We share the current evidence with pilot customers on request. FAQ ## Frequently asked questions ### Can Sembric see our warehouse credentials? The Sembric runtime holds the customer identities mapped to each role as runtime-only secrets. Agents never receive source credentials, and the portal shows only names of secret references, never values. ### What does Sembric record about agent activity? Every agent query, answered or refused, with a caller naming its channel and, for keys, the public key identifier. Session tokens and their hashes are never written to audit details. ### Does Sembric limit warehouse spend? Every statement consumes persistent workspace minute and day read budgets before contact, and BigQuery jobs reserve a daily billed-byte allowance. These are on-demand query controls, not invoice limits. ## Review the model with your security team We’ll walk through identities, policies, audit evidence and the open gates with the people who need to sign off. [Request a pilot](https://sembric.app.arelis.digital/contact) · [Email us](mailto:contact@arelis.digital?subject=Sembric%20pilot%20request) --- Last updated 2026-10-14. Published by Arelis AI (https://arelis.digital). --- # Connect any MCP agent to answers your team has certified > Connect Claude Code or any MCP client to Sembric: eight read-only tools, revocable keys or OIDC tokens, typed filters and time grains, every call audited. Canonical URL: https://sembric.app.arelis.digital/agents Agents and MCP Sembric runs a stateless HTTP MCP server and a typed REST API. Every call is limited to the certified products, governed views and ontology entries granted to the caller’s current role. Tools ## Eight read-only tools Agents discover what they may use, read its definition, then query it. There is no tool that accepts SQL. Sembric MCP tools | Tool | Purpose | | --- | --- | | `sembric_list_products` | List the certified aggregate data products granted to the caller’s role. | | `sembric_describe_product` | Read a product’s definition, caveats, declared dimensions and their types. | | `sembric_query_product` | Query a product by up to three declared dimensions, typed filters and a bounded limit. | | `sembric_list_views` | List the certified governed views granted to the caller’s role. | | `sembric_describe_view` | Read a view’s approved columns, fixed restrictions and caveats. | | `sembric_query_view` | Read approved columns with typed filters; fixed row restrictions always apply. | | `sembric_list_concepts` | List business concepts grounded by surfaces the caller can see. | | `sembric_get_ontology` | Read typed relationships between those concepts. | Credentials ## Two ways for an agent to authenticate Direct clients ### Sembric API keys - Created on the Agents page for a member with the intended role; one-, seven- or 30-day lifetimes, one day by default. - Shown once, stored as a digest, revocable immediately. - Inherit the member’s current role, so a role change applies to their agents on the next call. User-linked ### OIDC access tokens - Signed JWTs from your configured issuer, with audience equal to Sembric’s /mcp resource and the sembric:read scope. - Must carry a verified email that matches exactly one current workspace member. - Sembric publishes protected-resource metadata so OAuth-aware clients can discover the requirement. Connect ## Verify the endpoint, then add it to your agent Use a short-lived key and a public HTTPS Sembric endpoint. The tool list returns only what the key’s member may see. List tools with curl ``` curl -fsS "$SEMBRIC_URL/mcp" \ -H "Authorization: Bearer $SEMBRIC_AGENT_KEY" \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' ``` Claude Messages API MCP connector ``` { "mcp_servers": [{ "type": "url", "url": "https://your-sembric.example.com/mcp", "name": "sembric", "authorization_token": "YOUR_SEMBRIC_AGENT_KEY" }], "tools": [{ "type": "mcp_toolset", "mcp_server_name": "sembric" }] } ``` Claude Code and other HTTP MCP clients connect to the same `/mcp` endpoint with the key as a bearer token. ChatGPT’s custom MCP connection requires the user-linked OAuth path. Asking richer questions ## Grouping, time grains and typed filters sembric\_query\_product groups by up to three declared dimensions. Date and timestamp dimensions accept day, week, month, quarter or year grains; send integers and decimals as strings and dates as YYYY-MM-DD. Arguments for sembric\_query\_product ``` { "productId": "…", "dimensions": ["ordered_at:quarter", "region"], "filters": { "region": { "in": ["North", "East"] }, "ordered_at": { "gte": "2026-01-01T00:00:00", "lt": "2027-01-01T00:00:00" } }, "limit": 20 } ``` ### Two deliberate refusals - A query matching more groups or rows than its limit is refused with narrowing guidance, never truncated. - Groups backed by fewer records than a product’s minimum are omitted, so an empty result can mean the group is too small to release. Monitoring ## See what your agents attempted Owners and engineers watch agent traffic over the last 24 hours, 7 days or 30 days. - Answered and refused calls, compared with the previous period, plus the products and views agents query most. - Recent refusals with the reason the agent received, and a live feed of the latest calls. - Every key with its holder, role, expiry and last use over MCP or REST. - Audit filters by channel, key, member and time. FAQ ## Frequently asked questions ### Does Sembric work with Claude? Yes. Claude Code and other MCP clients connect to Sembric’s HTTP MCP endpoint, and the Claude Messages API MCP connector can use the same endpoint with a short-lived key. ### What happens when we revoke a key? The agent is refused on its next call. Sembric also rechecks membership, role, the calling credential and the certificate after each source query, so a revocation during a query withholds its result. ### Why would a query come back empty or refused? A query matching more rows than its limit is refused with narrowing guidance rather than truncated, and a product’s minimum group size omits small groups. Undeclared fields, ungranted roles and uncertified surfaces are refused and audited. ## Give your agents their first certified surface We’ll help you certify a product on your own warehouse and connect Claude Code or your own agent to it. [Request a pilot](https://sembric.app.arelis.digital/contact) · [Email us](mailto:contact@arelis.digital?subject=Sembric%20pilot%20request) --- Last updated 2026-10-14. Published by Arelis AI (https://arelis.digital). --- # Governed agent access for the warehouses and engines you already run > Governed AI agent access for BigQuery, Snowflake, Trino, Databricks, PostgreSQL and MySQL, with a customer identity per role and source policies preserved. Canonical URL: https://sembric.app.arelis.digital/integrations Integrations Sembric connects to BigQuery, Snowflake, Trino, Databricks, PostgreSQL and MySQL with a customer identity per Sembric role. Your engine keeps enforcing its own policies; Sembric decides which certified answers an agent may receive. Connectors ## Six sources, one governed workflow - Google Cloud data warehouse ### [BigQuery](https://sembric.app.arelis.digital/integrations/bigquery) Discover a BigQuery dataset and serve certified aggregates and governed views to agents, with each Sembric role impersonating its own customer service account. - Cloud data platform ### [Snowflake](https://sembric.app.arelis.digital/integrations/snowflake) Connect a Snowflake schema over the SQL API with one key-pair user and role per Sembric role, and let agents query only certified surfaces. - Federated SQL engine and lakehouse catalogs ### [Trino](https://sembric.app.arelis.digital/integrations/trino) Discover one Trino catalog and schema, including a lakehouse catalog you operate, and serve certified surfaces through role-specific read-only users. - Databricks SQL warehouse with Unity Catalog ### [Databricks](https://sembric.app.arelis.digital/integrations/databricks) Connect a Databricks SQL warehouse and one Unity Catalog schema with a separate OAuth service principal per Sembric role. - Native PostgreSQL ### [PostgreSQL](https://sembric.app.arelis.digital/integrations/postgresql) Connect an existing PostgreSQL schema over verified TLS with a restricted login per Sembric role, keeping row-level security in force. - MySQL 8.0 and 8.4 ### [MySQL](https://sembric.app.arelis.digital/integrations/mysql) Connect a MySQL 8.0 or 8.4 database over mandatory verified TLS with direct read-only grants per Sembric role. Every connector ## Guarantees that hold for every source - Source rows stay in your engine; Sembric stores only reviewed metadata, definitions and audit records. - Each Sembric role maps to its own narrow customer identity, so source row and column policies keep applying. - Only owners connect sources, test role identities or change mappings. Engineers may rediscover. - Every submitted statement reserves workspace read budget before contact, including catalog pages and schema reads. - Queries check the live schema against the certified fingerprint and refuse drift. - Editing or pausing a source withdraws dependent reviews and certificates atomically; resuming requires rediscovery and recertification. A local DuckDB adapter exists for single-host pilots only; the isolated customer runtime disables it at startup. ## Put your first certified data product in front of an agent. Tell us which warehouse you run and what your agents need to answer. We will help you connect a source, certify a first surface and query it over MCP. [Request a pilot](https://sembric.app.arelis.digital/contact) · [Email us](mailto:contact@arelis.digital?subject=Sembric%20pilot%20request) --- Last updated 2026-10-14. Published by Arelis AI (https://arelis.digital). --- # Governed BigQuery access for AI agents > Give AI agents governed access to BigQuery: per-role service accounts, preserved row and column policies, billed-byte allowances and no SQL from agents. Canonical URL: https://sembric.app.arelis.digital/integrations/bigquery Integration · Google Cloud data warehouse Discover a BigQuery dataset and serve certified aggregates and governed views to agents, with each Sembric role impersonating its own customer service account. Identity ## How Sembric connects to BigQuery ### Per-role identity Each Sembric role maps to its own customer service account. The Sembric runtime holds Token Creator on those target accounts only and impersonates the account mapped to the acting role. ### Your policies stay in force BigQuery row-level and column-level policies stay in force because every query runs as the mapped account. Curated datasets or authorized views keep raw and regulated tables out of reach. Enforcement ## What Sembric checks and refuses - Discovery pages through the entire dataset and commits a new catalog only after every metadata call succeeds. - Nested STRUCT and repeated ARRAY fields keep their full type in the reviewed fingerprint, start sensitive when a nested field name looks personal, and can never be measures or dimensions. - Every result page is read; repeated or missing page tokens are refused, so a partial page is never treated as the whole answer. - NUMERIC, BIGNUMERIC and wide integers return as exact strings; timestamps return as ISO strings. - Each job reserves from a workspace UTC-day billed-byte allowance (10 GB by default) before it starts and carries a matching maximumBytesBilled and a 30-second timeout. Limits ## What these controls don’t do - The billed-byte allowance is an on-demand query control, not an invoice limit: capacity reservations, storage and other Google Cloud charges are outside it. Keep project budgets and billing alerts. - Only confirmed billed bytes return unused allowance; failed or uncertain jobs keep their full reservation. Setup ## Connecting BigQuery 1. Create one service account per Sembric role with metadata and data read on the chosen dataset or authorized views, plus BigQuery Job User on the billing project. 2. Grant the Sembric runtime identity Token Creator on those service accounts only. In an isolated customer plane, the connection form shows the exact identity to grant. 3. An owner enters the data project, dataset, billing project, location, per-query billed-byte cap and the account for each role, then tests every mapping before saving. 4. Discover the dataset, have the asset’s steward review classifications, then define and independently certify products and views. FAQ ## BigQuery questions ### Does Sembric need access to all of our BigQuery data? No. Each role’s service account should read only a curated dataset or authorized views. Sembric discovers what that account can see, and agents can reach only certified surfaces built on reviewed, non-sensitive fields. ### Can an agent run up a large BigQuery bill? Agents cannot send SQL. Every job reserves from a workspace daily billed-byte allowance and carries maximumBytesBilled. That bounds on-demand query bytes, but it is not an invoice limit, so keep project budgets and alerts too. ## Other integrations - [Snowflake](https://sembric.app.arelis.digital/integrations/snowflake) - [Trino](https://sembric.app.arelis.digital/integrations/trino) - [Databricks](https://sembric.app.arelis.digital/integrations/databricks) - [PostgreSQL](https://sembric.app.arelis.digital/integrations/postgresql) - [MySQL](https://sembric.app.arelis.digital/integrations/mysql) ## Put your first certified data product in front of an agent. Tell us which warehouse you run and what your agents need to answer. We will help you connect a source, certify a first surface and query it over MCP. [Request a pilot](https://sembric.app.arelis.digital/contact) · [Email us](mailto:contact@arelis.digital?subject=Sembric%20pilot%20request) --- Last updated 2026-10-14. Published by Arelis AI (https://arelis.digital). --- # Governed Snowflake access for AI agents > Give AI agents governed access to Snowflake: key-pair users per role, grant checks before every statement, preserved masking and row access policies. Canonical URL: https://sembric.app.arelis.digital/integrations/snowflake Integration · Cloud data platform Connect a Snowflake schema over the SQL API with one key-pair user and role per Sembric role, and let agents query only certified surfaces. Identity ## How Sembric connects to Snowflake ### Per-role identity Each Sembric role uses its own Snowflake service user, role and RSA key pair over the SQL API. Private keys stay on the runtime and never enter source metadata, the portal or logs. ### Your policies stay in force Snowflake access control, row access policies and masking policies stay authoritative. Certification runs every check under each granted role’s identity, so a policy that changes answers per role is visible during review. Enforcement ## What Sembric checks and refuses - Before any data statement Sembric reads SHOW GRANTS TO ROLE and refuses administrative roles, inherited roles, grant options and write or ownership privileges. A passing check is reused for ten minutes per identity. - Only the exact account origin is allowed; other origins, redirects, paths and plain HTTP are refused. - Statements use positional bindings with reviewed casts, TIMEZONE=UTC and bounded jsonv2 result partitions. - Users, environment variables and keys must differ across roles; the source form refuses two roles that resolve to the same key. Limits ## What these controls don’t do - The statement timeout (30 seconds by default) and best-effort cancellation do not cap warehouse credits. Setup ## Connecting Snowflake 1. For each Sembric role, create a dedicated Snowflake role and service user with USAGE on the warehouse, database and schema and SELECT on only the chosen tables or secure views. 2. Generate an RSA key pair per user, register the public key, and provision the private key on the Sembric runtime under a role-named secret. 3. Allow the exact account origin, then have an owner enter the warehouse, database, schema and role mappings and test every mapping before saving. 4. Discover, review classifications, and certify products and views with an independent reviewer. FAQ ## Snowflake questions ### Why does Sembric refuse a Snowflake role that inherits another role? Inherited roles can change a role’s effective grants without notice. Sembric requires narrow, direct read grants so the identity a reviewer certified is the identity that serves agents. ### Do masking policies still apply? Yes. Queries run as the Snowflake role mapped to the caller’s Sembric role, so Snowflake’s own masking and row access policies decide what that role reads. ## Other integrations - [BigQuery](https://sembric.app.arelis.digital/integrations/bigquery) - [Trino](https://sembric.app.arelis.digital/integrations/trino) - [Databricks](https://sembric.app.arelis.digital/integrations/databricks) - [PostgreSQL](https://sembric.app.arelis.digital/integrations/postgresql) - [MySQL](https://sembric.app.arelis.digital/integrations/mysql) ## Put your first certified data product in front of an agent. Tell us which warehouse you run and what your agents need to answer. We will help you connect a source, certify a first surface and query it over MCP. [Request a pilot](https://sembric.app.arelis.digital/contact) · [Email us](mailto:contact@arelis.digital?subject=Sembric%20pilot%20request) --- Last updated 2026-10-14. Published by Arelis AI (https://arelis.digital). --- # Governed Trino access for AI agents > Give AI agents governed access to Trino and lakehouse catalogs: read-only users per role, origin allowlists, Trino access control and no agent SQL. Canonical URL: https://sembric.app.arelis.digital/integrations/trino Integration · Federated SQL engine and lakehouse catalogs Discover one Trino catalog and schema, including a lakehouse catalog you operate, and serve certified surfaces through role-specific read-only users. Identity ## How Sembric connects to Trino ### Per-role identity Each Sembric role uses a distinct read-only Trino user over HTTPS with password authentication. Passwords live in runtime secrets and are never entered in the portal. ### Your policies stay in force Trino’s access-control policy enforces table, column and row restrictions. Sembric does not manage the catalog, ingest rows, create source views or transform data. Enforcement ## What Sembric checks and refuses - Only exact coordinator origins are allowed, and cross-origin result links are refused. - Queries use USING parameters and a 30-second client deadline, and check the live schema against the certified fingerprint before execution. - Every request sets a coordinator-side run-time limit and a physical-scan session setting. - Each mapped role needs a different username, password variable and underlying secret. Limits ## What these controls don’t do - The physical-scan setting depends on the connector: a PostgreSQL-backed fixture returns rows despite a 1-byte setting. Neither setting is a cost cap, so enforce source-side resource groups or quotas. - In an isolated customer plane, serving traffic leaves through a customer-specific NAT address you can allowlist. That gives a stable address, not a destination firewall; verify the observed IP before relying on it. Setup ## Connecting Trino 1. Enable HTTPS and password authentication on the coordinator, and create a distinct read-only Trino user for every Sembric role that will receive a grant. 2. Enforce table, column and row restrictions in Trino’s access-control policy. 3. List the exact coordinator origin on the Sembric runtime and store each role’s password as a runtime secret. 4. An owner chooses one catalog and schema, tests every role mapping, then discovers, reviews and certifies. FAQ ## Trino questions ### Can Sembric govern a lakehouse through Trino? Yes. Trino can expose a lakehouse catalog you configure. Sembric discovers that catalog’s schema, and your Trino policies keep enforcing access under each role’s user. ### Does the Trino scan setting cap our costs? No. Its effect depends on the connector, so Sembric does not treat it as a cost control. Use source-side resource groups or quotas. ## Other integrations - [BigQuery](https://sembric.app.arelis.digital/integrations/bigquery) - [Snowflake](https://sembric.app.arelis.digital/integrations/snowflake) - [Databricks](https://sembric.app.arelis.digital/integrations/databricks) - [PostgreSQL](https://sembric.app.arelis.digital/integrations/postgresql) - [MySQL](https://sembric.app.arelis.digital/integrations/mysql) ## Put your first certified data product in front of an agent. Tell us which warehouse you run and what your agents need to answer. We will help you connect a source, certify a first surface and query it over MCP. [Request a pilot](https://sembric.app.arelis.digital/contact) · [Email us](mailto:contact@arelis.digital?subject=Sembric%20pilot%20request) --- Last updated 2026-10-14. Published by Arelis AI (https://arelis.digital). --- # Governed Databricks access for AI agents > Governed AI agent access to Databricks: OAuth service principals per role, Unity Catalog row filters and masks preserved, bounded results and no agent SQL. Canonical URL: https://sembric.app.arelis.digital/integrations/databricks Integration · Databricks SQL warehouse with Unity Catalog Connect a Databricks SQL warehouse and one Unity Catalog schema with a separate OAuth service principal per Sembric role. Identity ## How Sembric connects to Databricks ### Per-role identity Each Sembric role uses a different OAuth machine-to-machine service principal that requests only the sql scope. Secrets are runtime-only references; source metadata stores only the principal’s client ID. ### Your policies stay in force Unity Catalog grants, row filters and column masks remain authoritative. Principals receive CAN USE on the warehouse and USE CATALOG, USE SCHEMA and SELECT on chosen tables only. Enforcement ## What Sembric checks and refuses - Only the exact workspace origin is allowed, and redirects are refused so credentials cannot be forwarded. - Statements use named parameters and bounded INLINE results through the SQL Statement Execution API; truncated or malformed results are refused. - Full Unity Catalog types enter the reviewed fingerprint; nested or repeated fields start sensitive when a field name looks personal and cannot be measures or dimensions. - A workspace read is reserved before every submitted statement, including each metadata page; polling and result chunks share that reservation. Limits ## What these controls don’t do - Cancellation after 5–25 seconds and response limits do not cap scan bytes or DBUs. Setup ## Connecting Databricks 1. Create a service principal per Sembric role with the SQL entitlement, CAN USE on the warehouse, and USE CATALOG, USE SCHEMA and SELECT on only the chosen tables or curated views. 2. Generate a sql-scoped OAuth secret per principal and provision it on the runtime under a role-named reference. 3. Allow the exact workspace origin, then have an owner enter the warehouse ID, catalog, schema and role mappings and test each one. 4. Discover, review classifications and certify with an independent reviewer. FAQ ## Databricks questions ### Do Unity Catalog row filters and column masks still apply? Yes. Each query runs as the service principal mapped to the caller’s Sembric role, so Unity Catalog decides what that principal reads. ### Does Sembric cap DBU spend? No. Sembric bounds statement count, time and response size, but not scan bytes or DBUs. Keep Databricks-side controls in place. ## Other integrations - [BigQuery](https://sembric.app.arelis.digital/integrations/bigquery) - [Snowflake](https://sembric.app.arelis.digital/integrations/snowflake) - [Trino](https://sembric.app.arelis.digital/integrations/trino) - [PostgreSQL](https://sembric.app.arelis.digital/integrations/postgresql) - [MySQL](https://sembric.app.arelis.digital/integrations/mysql) ## Put your first certified data product in front of an agent. Tell us which warehouse you run and what your agents need to answer. We will help you connect a source, certify a first surface and query it over MCP. [Request a pilot](https://sembric.app.arelis.digital/contact) · [Email us](mailto:contact@arelis.digital?subject=Sembric%20pilot%20request) --- Last updated 2026-10-14. Published by Arelis AI (https://arelis.digital). --- # Governed PostgreSQL access for AI agents > Give AI agents governed access to PostgreSQL: verified TLS, restricted logins per role, row-level security preserved, read-only transactions, no agent SQL. Canonical URL: https://sembric.app.arelis.digital/integrations/postgresql Integration · Native PostgreSQL Connect an existing PostgreSQL schema over verified TLS with a restricted login per Sembric role, keeping row-level security in force. Identity ## How Sembric connects to PostgreSQL ### Per-role identity Each Sembric role uses its own restricted login and runtime-only password reference. TLS certificate and hostname verification is always on, and an operator allowlists the exact host, port and database. ### Your policies stay in force Row-level security and column grants stay in force. Superusers, BYPASSRLS logins and table owners can bypass row policies, which is why Sembric refuses those mappings. Enforcement ## What Sembric checks and refuses - On every connection, before the data statement, Sembric refuses administration, BYPASSRLS, schema creation, relation ownership and write privileges in the chosen schema. - Reads run in read-only transactions with $n parameters, server statement timeouts and bounded streaming responses. - Composite, array, domain and enum types keep their full definitions in the reviewed fingerprint. - Source connections never reuse Sembric’s own metadata database credentials, pools or type parsers. Limits ## What these controls don’t do - Time and response controls do not cap scan bytes or server cost; set connection limits and resource controls on your server. Setup ## Connecting PostgreSQL 1. Create a separate login per Sembric role with CONNECT on the database, USAGE on the schema and SELECT on approved tables, views or columns only. 2. Have an operator allowlist the exact endpoint and provision each role’s password as a runtime secret (and a private CA bundle if you use one). 3. An owner enters the endpoint, schema, logins and secret references and tests every mapping. 4. Discover, review classifications and certify with an independent reviewer. FAQ ## PostgreSQL questions ### Will PostgreSQL row-level security still apply? Yes. Queries run as the login mapped to the caller’s role, and Sembric refuses logins that could bypass row policies, such as superusers, BYPASSRLS roles and table owners. ### Can we turn off TLS for a private network? No. Certificate and hostname verification is always enabled. Use a private CA bundle if your server is not signed by a public authority. ## Other integrations - [BigQuery](https://sembric.app.arelis.digital/integrations/bigquery) - [Snowflake](https://sembric.app.arelis.digital/integrations/snowflake) - [Trino](https://sembric.app.arelis.digital/integrations/trino) - [Databricks](https://sembric.app.arelis.digital/integrations/databricks) - [MySQL](https://sembric.app.arelis.digital/integrations/mysql) ## Put your first certified data product in front of an agent. Tell us which warehouse you run and what your agents need to answer. We will help you connect a source, certify a first surface and query it over MCP. [Request a pilot](https://sembric.app.arelis.digital/contact) · [Email us](mailto:contact@arelis.digital?subject=Sembric%20pilot%20request) --- Last updated 2026-10-14. Published by Arelis AI (https://arelis.digital). --- # Governed MySQL access for AI agents > Give AI agents governed access to MySQL 8.0 and 8.4: verified TLS, direct read-only grants per role, customer-owned views for restrictions, no agent SQL. Canonical URL: https://sembric.app.arelis.digital/integrations/mysql Integration · MySQL 8.0 and 8.4 Connect a MySQL 8.0 or 8.4 database over mandatory verified TLS with direct read-only grants per Sembric role. Identity ## How Sembric connects to MySQL ### Per-role identity Each Sembric role uses a distinct serving-only login over mandatory verified TLS. An operator allowlists the exact host, port and database. ### Your policies stay in force Customer-owned views and column grants enforce restrictions. MySQL has no native row policies like PostgreSQL’s, and Sembric does not claim them. Enforcement ## What Sembric checks and refuses - Before any data SQL, Sembric refuses write, administrative, global or foreign-database grants, proxy and role grants, and grant options; only direct SELECT and SHOW VIEW grants are supported. - Reads use read-only transactions and binary prepared parameters. - Native types, enum and set labels and collations enter the reviewed fingerprint, so a change withdraws access. - MariaDB and versions outside 8.0 and 8.4 are refused. Limits ## What these controls don’t do - Server execution settings and client deadlines stop release after limits, but do not cap source scan cost or guarantee immediate cancellation. Setup ## Connecting MySQL 1. Create a login per Sembric role with direct SELECT (and SHOW VIEW where needed) on approved tables, views or columns only. 2. Use customer-owned views to express row restrictions, and verify them under each login. 3. Have an operator allowlist the exact endpoint and provision each password as a runtime secret; an owner then tests every mapping. 4. Discover, review classifications and certify with an independent reviewer. FAQ ## MySQL questions ### How do we restrict rows in MySQL? Use customer-owned views and column grants for each role’s login. Certification runs its checks under every granted login, so a view that changes answers per role is visible during review. ### Is MariaDB supported? Not yet. Sembric supports MySQL 8.0 and 8.4 and refuses other engines until they have their own acceptance work. ## Other integrations - [BigQuery](https://sembric.app.arelis.digital/integrations/bigquery) - [Snowflake](https://sembric.app.arelis.digital/integrations/snowflake) - [Trino](https://sembric.app.arelis.digital/integrations/trino) - [Databricks](https://sembric.app.arelis.digital/integrations/databricks) - [PostgreSQL](https://sembric.app.arelis.digital/integrations/postgresql) ## Put your first certified data product in front of an agent. Tell us which warehouse you run and what your agents need to answer. We will help you connect a source, certify a first surface and query it over MCP. [Request a pilot](https://sembric.app.arelis.digital/contact) · [Email us](mailto:contact@arelis.digital?subject=Sembric%20pilot%20request) --- Last updated 2026-10-14. Published by Arelis AI (https://arelis.digital). --- # Why we built Sembric > Why Sembric exists: agents should get answers people have vouched for, while customer data stays in its source and the warehouse stays authoritative. Canonical URL: https://sembric.app.arelis.digital/about About Companies want AI agents to answer questions from their data. The data is already governed in the warehouse; the risk is in how agents reach it. Sembric is the missing layer in between. What we believe ## Agents should get answers people have vouched for Most organisations spent years putting row policies, column grants and data ownership in place. Connecting an agent with a service account and a text-to-SQL prompt quietly bypasses all of it: the agent can read what the account can read, write any query, and nobody reviewed the number it returns. We think the right unit of access for an agent is not a table but a certified answer — a definition someone owns, a classification a steward reviewed, and checks an independent reviewer ran under every role that will use it. When any of that changes, access should stop on its own. Principles ## How we build - Customer data stays in its source. We don’t add ingestion, transformation or free-form SQL. - The source engine stays authoritative; Sembric only narrows access further. - Fail closed: when facts change, withdraw access and record why. - Say exactly what a control does and doesn’t do — including the limits of our own cost and privacy controls. - Claim only what we have evidence for. Company ## Sembric is built by Arelis AI Arelis AI builds governance and integration software for enterprise AI. Sembric is available for pilots today. [Visit Arelis AI](https://arelis.digital) ## Put your first certified data product in front of an agent. Tell us which warehouse you run and what your agents need to answer. We will help you connect a source, certify a first surface and query it over MCP. [Request a pilot](https://sembric.app.arelis.digital/contact) · [Email us](mailto:contact@arelis.digital?subject=Sembric%20pilot%20request) --- Last updated 2026-10-14. Published by Arelis AI (https://arelis.digital). --- # Start a Sembric pilot on your own warehouse > Start a Sembric pilot on your own warehouse: connect one source, certify a first data product or governed view, and query it from an agent over MCP. Canonical URL: https://sembric.app.arelis.digital/contact Request a pilot A pilot connects one source, certifies a first data product or governed view with your team, and puts it in front of an agent over MCP. Get in touch ## Email us with a few details ### Pilot requests [contact@arelis.digital](mailto:contact@arelis.digital?subject=Sembric%20pilot%20request) [Email a pilot request](mailto:contact@arelis.digital?subject=Sembric%20pilot%20request) This site has no forms and sets no cookies. Your message goes only to our inbox. ### Helpful to include - Which warehouse or engine holds the data: BigQuery, Snowflake, Trino, Databricks, PostgreSQL or MySQL - The first questions your agents should answer, and who owns that data today - Which agents or clients you use, such as Claude Code or your own MCP client - Any security or compliance review the pilot needs to pass Please don’t send credentials or customer data by email. --- Last updated 2026-10-14. Published by Arelis AI (https://arelis.digital). --- # Website privacy notice > Sembric’s website sets no cookies and runs no trackers. Learn what our hosting logs, how the theme preference is stored and how we use email you send us. Canonical URL: https://sembric.app.arelis.digital/privacy Privacy How Sembric’s website at sembric.app.arelis.digital handles information. It covers this website only, not the Sembric product. Last updated 2026-10-14 ## The short version This website sets no cookies, runs no analytics or advertising scripts, embeds no third-party content and has no forms. Fonts and scripts are served from this domain. ### Theme preference If you switch between light and dark themes, your choice is stored in your browser’s local storage under the key `sembric-theme`. It never leaves your device; clear site data to remove it. ### Server logs Like any web server, our hosting on Google Cloud receives your IP address, user agent, the requested path and the time of each request. These request logs are used to operate and secure the site and are kept in Google Cloud Logging under its default retention. ### Email If you email [contact@arelis.digital](mailto:contact@arelis.digital), we use your message and address to reply and to discuss a pilot with you. ### Questions Contact [contact@arelis.digital](mailto:contact@arelis.digital) with any question about this notice. --- Last updated 2026-10-14. Published by Arelis AI (https://arelis.digital).