This page describes AAES Govern’s controls. AAES Operate has private-work permissions, operational reviews and recorded-spend limits; it does not include Govern. About AAES Govern
Before you enable this package
Draft package; not part of the reviewed library. This draft is held and not yet available: AAES has no MySQL driver, so every capability in this package is refused before a connection is attempted. It stays unusable unless AAES adds a MySQL driver and the package passes review again.
Read each action's effects and exclusions below. Before installation, also read the complete package requirements, including credential issuance, scope, expiry, and provider permissions. These are deployment prerequisites, not capabilities this package supplies.
Capabilities (4)
Each capability below is one registered operation. The complete package JSON includes its exact network destination allowlist. The repository stores it at packs/mysql.json and embeds a copy in the release binary.
Risk tiers. R0 is the minimum for reads. R2 is the minimum for write, create, update, execute, and invoke. R3 is the minimum for delete, send, pay, deploy, approve, share, and transfer. Operators can raise these levels. A minimum tier does not measure the operation's business or confidentiality risk.
On supported execution paths routed through AAES Govern, the R3 actions listed below require approval by an authorized person. Bypass paths and observation-only registrations are outside that guarantee. A provider's restoration feature does not remove this approval requirement. A provider-side approval, such as approving a GitLab merge request, is also separate from AAES Govern human approval. The capability matrix shows which execution paths are implemented, restricted to lab use, or refused at startup. Live compatibility must be tested in your environment.
Field guide. Endpoint is the service address and request method. Connector is the adapter that makes the call. Custody describes how the credential is held; the credential reference identifies the value to resolve. Data class sets handling requirements: pii means personal data, financial means financial records, and internal means internal organizational data.
mysql.table.query v1.0.0R0
- Kind
- tool
- Action
- read
- Endpoint
query mysql://DB_HOST:3306/DB_NAME- Connector
- sql
- Custody
- customer_vault
- Credential ref
secret-ref-mysql-role- Data class
- pii
Query table.
Run an allowlisted SELECT against the table. DB_HOST, DB_NAME and the table behind mysql-table are placeholders.
mysql.row.insert v1.0.0R2
- Kind
- tool
- Action
- create
- Endpoint
exec mysql://DB_HOST:3306/DB_NAME- Connector
- sql
- Custody
- customer_vault
- Credential ref
secret-ref-mysql-role- Data class
- pii
Insert row.
Run an allowlisted INSERT against the table. The deployment statement allowlist must hold the exact statement; this registration names the operation and does not supply that control.
mysql.row.update v1.0.0R2
- Kind
- tool
- Action
- update
- Endpoint
exec mysql://DB_HOST:3306/DB_NAME- Connector
- sql
- Custody
- customer_vault
- Credential ref
secret-ref-mysql-role- Data class
- pii
Update row.
Run an allowlisted UPDATE against the table, registered at the R2 minimum for update. An overwritten value may be unrecoverable without a backup; assess that separately.
mysql.row.delete v1.0.0R3
- Kind
- tool
- Action
- delete
- Endpoint
exec mysql://DB_HOST:3306/DB_NAME- Connector
- sql
- Custody
- customer_vault
- Credential ref
secret-ref-mysql-role- Data class
- pii
Delete row.
Run an allowlisted DELETE against the table. Delete is one of the designated actions requiring human approval, so the operator approval gate applies.
Credential reference
The credential field names a reference rather than containing credential material. Packs are designed not to contain secrets; the format checks cover only known credential formats and cannot prove that arbitrary text contains no secrets. Installing a package registers its capabilities. Configure the provider credentials, endpoints, and network access, then test the integration in your environment before enabling it.
- Reference
secret-ref-mysql-role- Custody
- customer_vault
- Injection
- header (Authorization)
Configure the value and injection format specified in the package. Assign responsibility for credential rotation and revocation, restrict provider permissions, and keep credential material out of logs and responses.
Complete credential requirements
A dedicated least-privilege MySQL login held in the client's own secret manager. The adapter reads the material as strict JSON with exactly user and password, presents it only during the TLS-protected login and never interpolates it into a statement. A result that echoes the password is refused. Integrated, Kerberos, cleartext-plugin and certificate authentication are not covered.
Resources
mysql-table(table, pii):mysql://DB_HOST:3306/DB_NAME/TABLE_NAME
Technical package and review record
Complete provider requirements and exclusions
Draft awaiting owner review. Select the MySQL adapter with native_executors.sql.engine set to mysql; every SQL capability in that deployment must then use a mysql:// endpoint, and a registration for another engine is refused when the configuration loads. The adapter (aaes/internal/connectors/native_mysql.go, go-sql-driver/mysql v1.10.1, reviewed in ADR-046) connects only to the registered host, port and database. It resolves the host through the connectors' pinned egress dial (public addresses, RFC 1918 and unique-local addresses only with egress_private_networks), requires TLS 1.2 or later with the certificate verified against the registered host name, and refuses a server that does not offer TLS before sending credentials. Parameters are bound as server-side prepared statement arguments and never interpolated. Statements must match the deployment allowlist byte for byte, must start with SELECT, INSERT, UPDATE, DELETE, REPLACE or WITH, and may not name INTO OUTFILE, INTO DUMPFILE, INFILE or LOAD_FILE; multi-statement strings, comments and CALL are refused.
A query capability runs with the session variable transaction_read_only set to ON and inside START TRANSACTION READ ONLY, and the transaction is always rolled back. MySQL then refuses changes to tables visible to other transactions, including writes made by a stored function the statement calls. TEMPORARY tables stay writable in that mode, so the login's grants remain a required control. The adapter needs MySQL 8.0 or later (transaction_read_only); it was tested against MySQL 8.4.
DB_HOST, DB_NAME and TABLE_NAME are placeholders. MySQL listens on TCP 3306 by default (MySQL's connection guide names 3306 as the default port); substitute the real host, port and database in the endpoint, the egress allowlist and the resource locator together.
Read operations are registered at R0, inserts and updates at R2, and deletion at R3. On supported execution paths mediated by AAES Govern, delete requires approval by an authorized person; bypass and observation-only paths are outside that guarantee. The SQL connector's method vocabulary is query or exec, not HTTP methods. A capability named row.insert is a promise about the statement the deployment allowlist will permit, not a check this file makes. Every capability touches one table resource classified pii as a starting point; a deployment whose table holds no personal data may lower it, and one holding payment or health data must raise it.
Least privilege lives in the database, not in this pack: grant the login SELECT on the one table for query capabilities, and INSERT, UPDATE or DELETE on that table only for the write capabilities you enable. Review the login's grants and the statement allowlist before enabling any write.
AAES has not been certified by the database vendor; the endpoints here are configuration to review and test, and the vendor has not endorsed it.
Download the complete package JSON for exact network allowlists, credential requirements, exclusions, and setup notes. Read these requirements before installation.
The full documentation review record is supplied in the evaluation package. The evaluation package runs in your environment and comes only with the paid design partnership. This page reproduces the source links and review block; the full record is available for evaluation. Discuss a design partnership to inspect it before installation.
Review block
This section reproduces the review block recorded in the pack file. The evidence and approval record is separate: for a reviewed pack, it is in the evaluation materials and in the release binary's embedded assets.
Review in progress; record dated 2026-10-29
3 sources, retrieved 2026-10-29
- https://dev.mysql.com/doc/refman/8.4/en/connecting.html (retrieved 2026-10-29)
- https://dev.mysql.com/doc/refman/8.4/en/commit.html (retrieved 2026-10-29)
- https://dev.mysql.com/doc/refman/8.4/en/set-transaction.html (retrieved 2026-10-29)
Current documentation links are navigation aids. They do not change the package, its historical sources or its review date. Review dates describe a documentation review, not a live integration test. No package is provider-endorsed or yet tested against a live provider tenant.
Release identity
SHA-256 of the pack file bytes: 8631984a0ef4c800fe8b2b3414cf3f8765068e5ca7a8c0cfab7e74556d63f217
Not part of the reviewed release library. Editing a package changes its release identity. A deployment plan checks its own file digests; it does not restore reviewed status or authenticate approval.