Data Castle is an integrated security solution that closes database access in one architecture, from the network layer down to the table layer. Every access decision is rule-based and 100% deterministic — whether the caller is a human, an application or an AI agent.
| Protection | Table | Authorized user | Commands | Policy | Status |
|---|---|---|---|---|---|
| CUSTOMER_ORDERS | ERPAPP.CUSTOMER_ORDER_TAB | ORDER_MANAGER | SELECT | DC_VPD_0141 | active |
| FINANCE_LEDGER | ERPAPP.GL_VOUCHER_TAB | FIN_CONTROLLER | SELECT | DC_VPD_0142 | active |
| PAYROLL | ERPAPP.EMP_SALARY_TAB | HR_PAYROLL | SELECT, UPDATE | DC_VPD_0143 | active |
| SUPPLIER_INVOICES | ERPAPP.SUPPLIER_INVOICE_TAB | AP_CLERK | SELECT | DC_VPD_0144 | active |
| CUSTOMER_PII | ERPAPP.CUSTOMER_INFO_TAB | — | — | DC_VPD_0145 | sealed |
Architectural constants.
For years database security was built to answer a single question: is this user authorized? But the connection may now be opened by a copilot, an integration or an agent — with an authorized identity and a manipulated request.
Data Castle trusts context, not identity — no client reaches protected data unless source IP, user identity and a secure session context are all verified together. A compromised AI agent included.
No Database Vault, Audit Vault or Firewall licence needed.
No change to your existing architecture.
No access decision left to a model.
Data Castle is not a Vault imitation, and it is not a general-purpose security layer. It builds protection across three layers at once: as the connection opens, as the table is read, and when someone tries to change the policy.
Every connection to the database passes through a single gate. Including administrators connecting remotely, no off-box access can bypass this layer. Traffic is monitored in real time and unauthorized connections are cut immediately. Every TNS frame is parsed and every decision written into a tamper-evident audit chain: each event is bound to the previous one with blake3, and chain integrity is verifiable with a single command.
| Time | Keyword | User | Client IP | Decision |
|---|---|---|---|---|
| 09:14:22 | SELECT | ORDER_MANAGER | 10.40.11.8 | LOG |
| 09:13:48 | DROP | DBSYS | 185.62.44.19 | DENY |
| 09:12:31 | SELECT | SVC_COPILOT | 10.40.60.4 | DENY |
| 09:11:57 | UPDATE | FIN_CONTROLLER | 10.40.11.9 | LOG |
| 09:10:02 | GRANT | DBA_ADMIN | 172.16.3.77 | DENY |
Access to protected tables depends on source IP, user identity and a secure session context being verified all three at once. Protection is built on the standard VPD capability of Enterprise Edition, and the policy binds to the object itself — not to the calling code. That is why it cannot be bypassed through packages, procedures or dynamic SQL.
| table | ERPAPP.CUSTOMER_ORDER_TAB |
| commands | SELECT |
| user | ORDER_MANAGER |
| policy | DC_VPD_0141 |
| predicate | context-bound |
The privileges that could lift the protection — exemption privileges included — are held apart from the DBAs who run the database. The identity doing daily operations and the identity able to change security policy are never the same. Even if a powerful administrator account is compromised, no one can alter the protection rule alone.
More AI agents and copilot integrations reach databases every month. That is a new attack surface: prompt injection, over-privileged AI access, a model manipulated into pulling data it should not. Data Castle is closed to this risk from two directions.
Access decisions rest on no AI model and no probabilistic guess. They are rule-based, 100% deterministic and repeatable; the same request returns the same result every time. That gives you full defensibility in front of financial regulators and supervisory authorities. Your security product is not itself a black box, and the extracts an auditor asks for arrive already mapped to their articles.
The protection does not trust whether the connecting software is a human, an application or an AI agent. No client reaches protected data until source IP, user identity and session context are verified. A compromised or manipulated agent is no exception to this rule.
| Client | Identity | Context | Result |
|---|---|---|---|
| Human · SQL client | ORDER_MANAGER | valid | allow |
| Application server | ORDER_MANAGER | valid | allow |
| AI agent · copilot | SVC_COPILOT | missing | deny |
| AI agent · prompt injected | ORDER_MANAGER | forged | deny |
| Scheduled job | SVC_BATCH | valid | allow |
Privileged and shared users — DBAs included — are blocked from protected tables at the database level. AI integrations usually run under broadly privileged service accounts; with Data Castle those privileges are no longer a guarantee of access.
| User | DBA_ADMIN |
| Privileges held | SELECT ANY TABLE, DBA |
| Paths attempted | direct SELECT → package → dynamic SQL |
| Session context | missing |
Event summaries and sample ids mapped to supervision articles.
Personal-data articles, right-to-erasure and data-masking findings.
Audit-log requirements 10.2.1 / 10.2.2 / 10.2.4 / 10.2.7.
DBA, SYS, SYSTEM and SYSDBA access with last-activity stamps.
Business units know the data is protected. Security, audit and IT teams get the determinability, separation of duties and audit trail they need to sign off.
Without touching your existing architecture, from day one. Example use cases:
Your infrastructure. Your rules. Your data.