Security
Sembric assumes agents will ask for things they shouldn’t. It answers only from reviewed, certified definitions, keeps your warehouse in charge of row and column access, and records every decision.
Principles
Sembric stores metadata, definitions, classifications, checks, certificate state and audit records. Source rows are read by bounded queries in your engine and never copied into Sembric.
Queries run as the customer identity mapped to the acting Sembric role, so source row and column policies keep applying. Sembric only narrows access further.
No agent route accepts SQL. Query builders accept declared fields only, bind every value as a typed parameter and enforce bounded limits.
Schema drift, reclassification, an extra or missing result column, an oversized response or a stale source version stops the release rather than passing it on.
Agent keys are random, stored as digests, shown once, expire within 90 days and can be revoked immediately. Members’ roles are re-read on every request.
Every agent query is audited, answered or refused, with a caller naming its channel and the public key identifier. Session tokens and their hashes are never recorded.
Identity and access
Query safety
Each step runs on every call to the API or MCP, for every connector.
Privacy in aggregates
A data product can set a reviewed minimum group size. The source query adds HAVING COUNT(*) >= n, so smaller groups — and filters that would isolate them — return no row in previews, certification, the API and MCP.
Threshold suppression is not complementary suppression. When a released total and the other released groups differ by exactly one withheld group, a caller could derive it by subtraction. For person-level data, keep dimensions coarse or don’t grant the product to roles that should never see small groups.
Audit and operations
Cost controls
Every statement submitted to a source consumes persistent workspace read budgets before contact — 120 per minute and 5,000 per UTC day by default — including previews, certification checks, catalog pages and schema reads.
These are on-demand query controls, not invoice limits. They do not cap warehouse credits, DBUs, capacity pricing or storage. Keep your own project budgets, quotas and billing alerts.
Deployment
Sembric’s commercial deployment design gives each customer its own Google Cloud workload project, a separate backup project and its own Cloud SQL instance, with the serving and migration identities kept apart.
FAQ
The Sembric runtime holds the customer identities mapped to each role as runtime-only secrets. Agents never receive source credentials, and the portal shows only names of secret references, never values.
Every agent query, answered or refused, with a caller naming its channel and, for keys, the public key identifier. Session tokens and their hashes are never written to audit details.
Every statement consumes persistent workspace minute and day read budgets before contact, and BigQuery jobs reserve a daily billed-byte allowance. These are on-demand query controls, not invoice limits.
We’ll walk through identities, policies, audit evidence and the open gates with the people who need to sign off.