# A security model built around your source, not around trust in the agent > How Sembric protects warehouse data from AI agents: per-role source identities, no SQL, fail-closed checks, revocable keys, full audit and honest cost limits. Canonical URL: https://sembric.app.arelis.digital/security Security Sembric assumes agents will ask for things they shouldn’t. It answers only from reviewed, certified definitions, keeps your warehouse in charge of row and column access, and records every decision. Principles ## Six rules Sembric does not bend - ### Data stays in its source Sembric stores metadata, definitions, classifications, checks, certificate state and audit records. Source rows are read by bounded queries in your engine and never copied into Sembric. - ### Your engine stays authoritative Queries run as the customer identity mapped to the acting Sembric role, so source row and column policies keep applying. Sembric only narrows access further. - ### No SQL from agents No agent route accepts SQL. Query builders accept declared fields only, bind every value as a typed parameter and enforce bounded limits. - ### Fail closed Schema drift, reclassification, an extra or missing result column, an oversized response or a stale source version stops the release rather than passing it on. - ### Revocable credentials Agent keys are random, stored as digests, shown once, expire within 90 days and can be revoked immediately. Members’ roles are re-read on every request. - ### Everything recorded Every agent query is audited, answered or refused, with a caller naming its channel and the public key identifier. Session tokens and their hashes are never recorded. Identity and access ## People, agents and source identities stay separate ### People - Portal single sign-on through your OIDC provider with authorization code and PKCE; a configured hosted domain is checked in the signed token. - Browser sessions are random tokens stored as SHA-256 digests in HttpOnly, SameSite=Strict cookies and expire after eight hours. - Removing a member deletes their sessions and revokes their API keys in the same transaction. ### Agents - Short-lived Sembric keys with one-, seven- or 30-day lifetimes, inheriting the issuing member’s current role. - Optional OIDC access tokens must be signed by the configured issuer, target the exact /mcp resource, carry sembric:read and map to one verified member. - Owners can revoke any member’s key; engineers monitor agents but revoke only their own keys. ### Sources - Only owners connect sources, test role identities or change mappings; engineers may rediscover. - Each Sembric role maps to a distinct, narrow customer identity; connectors refuse administrative, write and ownership privileges they can detect. - Source secrets are runtime-only references. The portal shows names of references, never values, and agents never see either. Query safety ## What happens on every agent query Each step runs on every call to the API or MCP, for every connector. 1. **Authenticate and authorize.** Resolve the key or token to a current member and role; refuse ungranted or uncertified surfaces and audit the refusal. 2. **Validate against the definition.** Accept only declared fields, typed filters and a bounded limit, and recheck the definition against the current classification. 3. **Reserve budget.** Atomically reserve the live schema check and the data statement against the workspace minute and day budgets; a refusal at this boundary consumes nothing and contacts no source. 4. **Check the live schema.** Compare it with the certified fingerprint and stop on any drift. 5. **Run a parameterized read.** Execute under the role’s source identity with the source’s own policies, deadlines and response bounds. 6. **Verify the result.** Release rows only if their keys exactly match the approved shape and the serialized size stays within the cap. 7. **Recheck access.** Re-read membership, role, the calling credential and the certificate before returning rows, then record the outcome. Privacy in aggregates ## Small groups, handled honestly A data product can set a reviewed minimum group size. The source query adds HAVING COUNT(\*) >= n, so smaller groups — and filters that would isolate them — return no row in previews, certification, the API and MCP. Threshold suppression is not complementary suppression. When a released total and the other released groups differ by exactly one withheld group, a caller could derive it by subtraction. For person-level data, keep dimensions coarse or don’t grant the product to roles that should never see small groups. Audit and operations ## Evidence you can hand to an auditor - Audit records cover source connection and discovery, classification, product changes, certification and failed checks, expiry, keys, invitations and every product and view query. - In the isolated Cloud SQL runtime, committed audit events are archived to create-only objects in a bucket in a separate backup project with a locked retention policy; the runtime cannot delete objects or administer the bucket. - Owners export workspace-scoped audit events as JSONL, one date range of up to 31 days at a time. - Notifications and outbox rows carry a title and a portal link only — never check details, source values, credentials or invitation links. - The runtime logs the request path only: never query strings, cookies, tokens, keys or source rows. Cost controls ## Bounded by design, honest about the limits Every statement submitted to a source consumes persistent workspace read budgets before contact — 120 per minute and 5,000 per UTC day by default — including previews, certification checks, catalog pages and schema reads. - BigQuery jobs also reserve a workspace UTC-day billed-byte allowance before job creation, capped by the source’s per-query maximumBytesBilled. - Snowflake, Databricks, PostgreSQL and MySQL apply statement timeouts and bounded responses; Trino sets coordinator-side run-time and physical-scan settings. These are on-demand query controls, not invoice limits. They do not cap warehouse credits, DBUs, capacity pricing or storage. Keep your own project budgets, quotas and billing alerts. Deployment ## Isolation per customer Sembric’s commercial deployment design gives each customer its own Google Cloud workload project, a separate backup project and its own Cloud SQL instance, with the serving and migration identities kept apart. - Serving traffic leaves through a customer-specific NAT address that public sources can allowlist. It is a stable address, not a destination firewall. - Cloud Armor applies a strict sign-in throttle and a configurable per-client edge limit. - Local DuckDB files are pilot-only and are disabled at startup in the isolated customer runtime. ### What we don’t claim yet Sembric is available for pilots. Its commercial acceptance gates — including a second-plane cross-tenant test, Cloud SQL failover, customer-scale load and recurring archive-integrity verification — are still open, and Sembric holds no third-party security certification today. We share the current evidence with pilot customers on request. FAQ ## Frequently asked questions ### Can Sembric see our warehouse credentials? The Sembric runtime holds the customer identities mapped to each role as runtime-only secrets. Agents never receive source credentials, and the portal shows only names of secret references, never values. ### What does Sembric record about agent activity? Every agent query, answered or refused, with a caller naming its channel and, for keys, the public key identifier. Session tokens and their hashes are never written to audit details. ### Does Sembric limit warehouse spend? Every statement consumes persistent workspace minute and day read budgets before contact, and BigQuery jobs reserve a daily billed-byte allowance. These are on-demand query controls, not invoice limits. ## Review the model with your security team We’ll walk through identities, policies, audit evidence and the open gates with the people who need to sign off. [Request a pilot](https://sembric.app.arelis.digital/contact) · [Email us](mailto:contact@arelis.digital?subject=Sembric%20pilot%20request) --- Last updated 2026-10-14. Published by Arelis AI (https://arelis.digital).