Grant the pipeline what it needs. Keep the trust boundary small.
Agents initiate control traffic, resolve Burst Load and CDC secrets locally, and keep row data outside the control plane. Direct-log capture can isolate elevated file or device access in a small broker.
The control plane never dials a database.
Credentials and relay keys remain on agents.
Expose allowlisted bytes without SQL or exec.
Burst Load data access
Keep source and target credentials inside the migration environment.
Agents resolve database and object-store secrets locally, open the source with the permissions required for the selected tables, and write through the target-native loading path. The control plane coordinates work without receiving plaintext credentials or row payloads.
Agent and control plane
Authenticate control without joining the row path.
Enrollment establishes stable identity, operators approve agents, and revocation persists. HTTPS, scoped keys, rate limits, sanitized faults, and audit protect mutations.
Database-side privilege
Separate log access from decode and apply.
For SQL Server Streaming and Sybase DirectDevice, a broker serves allowlisted reads. Canonical paths, final-handle validation, caps, HMAC, and audit constrain privilege.
Keep exploring
See the connected parts of the platform.
Review exact privilege before deployment.
Bring hosting, identity, secret store, zones, and log constraints. We will map every credential.