Can one AI agent safely query several databases?
Updated · DBShifts
Short answer
Yes, if each database keeps its own rules. Give the agent one endpoint that routes every call to the right database's gateway, so that database's allowlist, masking and limits still apply. Allow cross-database joins only along links you define, never on masked columns, and keep every read in the log of the database it came from.
Key facts
- An agent that needs two databases does not need a superuser on a copy of both.
- Routing each call through the source database's own policy keeps per-database rules intact.
- Owner-defined links stop an agent from inventing joins between unrelated columns.
- Joining on a masked column would reveal which masked values match across databases.
- Each read belongs in the audit log of the database it came from.
Why not one big connection
The usual shortcut is to copy everything into one warehouse and give the agent access to that. It works until you notice the copy has none of the source systems' rules: the CRM's masking, billing's row restrictions and each team's access decisions are flattened into one permission set, and the copy has to be secured, refreshed and purged on its own.
One endpoint, separate rules
The agent should see one server with one set of tools, and say which database each call is for. Behind it, each call goes to that database's own gateway and is checked against its policy exactly as if the agent had connected there directly. Narrowing an agent per database still works, and a change to one database's policy affects only that database.
Joining across databases
Questions like 'which customers with overdue invoices opened a ticket this week' need a join across systems. Let the agent join only along links you have declared — billing.orders.customer_id matches crm.customers.id — and run each side through its own gateway. Refuse links on masked columns: if two masked email columns can be joined, the agent learns which masked values are equal, which is exactly what masking is meant to hide.
Checklist
- 1
One endpoint for the agent; every call names its source database
- 2
Each source keeps its own allowlist, masking, row filters and limits
- 3
The agent's access can be narrowed per source
- 4
Cross-database joins only along owner-defined links
- 5
No links on masked or unreadable columns
- 6
Each read logged by the database it came from
Common mistakes
Copying everything into one place for the agent
It removes the source systems' controls and creates a second store of regulated data that someone has to secure and keep in step.
Letting the agent join on anything
An agent that can match any column against any other will eventually join on an email or a name — and turn masked values into matched pairs.
One audit log with no source
When an investigation asks what was read from the billing database, a log that only says 'the agent queried' cannot answer.
How DBShifts does it
- A DBShifts federation groups several of your Agent Gateways behind one MCP endpoint and one token. Every tool takes a source, and the call runs through that gateway's policy, masking, budgets, injection shield and receipts.
- A federation token can be narrowed per source.
- query_linked joins two databases along links the owner defined: left rows are read through their gateway, matching right rows through the other gateway, and the result is a left join of at most 1,000 rows, with each side's receipt.
- Links on masked or unreadable columns are refused, both when they are saved and again for each token.
- Reads appear in each gateway's own log under the federation token's name.
Questions people also ask
Does the agent get to write SQL across databases?
No. It calls the same structured tools it would on a single gateway, plus a join tool that only follows links you defined.
Can the databases be different engines?
Yes. Each side is read by its own gateway, so a PostgreSQL CRM and a MySQL billing database can be linked.
Related questions
Give AI agents data access you can defend
Scoped tokens, PII masked on the server, every request audited. Free to start.
Start free18 answers in this series. See all.