How can AI agents reach a database that stays in my network?
Updated · DBShifts
Short answer
Run a small process inside your network that connects out to the gateway, keeps the database credentials in its own configuration, and runs only the reads the gateway sends — refusing anything that is not a read on its own side. Nothing connects in, no database password leaves your network, and revoking its key stops it at once.
Key facts
- An outbound-only connector needs no inbound firewall rule and no public database endpoint.
- Credentials kept in the connector's own configuration are never stored by the service it talks to.
- A connector that enforces read-only itself does not depend on the remote service behaving.
- A read-only database transaction is a second line beneath a statement check.
- The rows an agent is allowed to read still leave the network; the endpoint and the credentials do not.
Why inbound access is hard to approve
Most agent tools want a host, a port and a password. For a database on a private network that means a firewall exception, an allow-listed address range and a credential stored in a vendor's system — three things a security review has to accept, and often won't.
How an outbound data plane works
A small process runs next to the database. It holds the connection details itself, connects out over HTTPS, and asks the gateway for work. When an agent's request needs the database, the gateway queues the read; the data plane picks it up, runs it locally and posts the result back. The gateway then applies masking, filters and limits as it would for any database.
Defence in depth
Do not let the data plane trust the service that sends it work. It should accept a single read statement and nothing else, and run that read inside a read-only transaction that is rolled back. Then even a compromised or misconfigured control plane cannot turn it into a write path.
Checklist
- 1
No inbound firewall rule and no public database endpoint
- 2
Database credentials only in the data plane's own configuration
- 3
Only single read statements accepted, checked on the data plane
- 4
Reads run in read-only transactions where the engine supports them
- 5
A revocable key per data plane
- 6
Gateway masking, row filters, limits and audit still applied
Common mistakes
Assuming nothing leaves the network
The rows an agent is allowed to read do travel to the gateway and on to the agent. What stays inside is the database endpoint and its credentials. Decide with that in mind.
Trusting the control plane to stay read-only
If only the service enforces read-only, one bug or breach there reaches your database. The connector should refuse writes on its own.
Sharing one key across sites
One key per data plane means one revocation stops one site, without taking every other database offline.
How DBShifts does it
- dbshift data-plane run runs inside your network with a configuration of named connections; their passwords come from that machine's environment and are never sent to DBShifts.
- It connects out over HTTPS, long-polls for work and posts results back. Nothing connects in.
- It accepts only a single read statement and runs PostgreSQL- and MySQL-family reads in read-only transactions that are rolled back, whatever it is asked.
- Gateways that use it store no database password; masking, row filters, limits, receipts and the audit log apply as usual.
- Revoking the data plane's key ends its requests at once, and the process stops.
Questions people also ask
Do query results leave my network?
Yes, the rows an agent is allowed to read: they go to the gateway, which masks them and returns them to the agent, as with a direct connection. The database endpoint and its credentials stay inside.
Which databases can it reach?
The engines DBShifts connects to. Read-only transactions are applied on PostgreSQL- and MySQL-family databases; on other engines the data plane relies on its statement check.
Related questions
Give AI agents data access you can defend
Scoped tokens, PII masked on the server, every request audited. Free to start.
Start free18 answers in this series. See all.