> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pawsql.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> PawSQL 是一个产品：Cloud 是公网部署形态，Engine / Optimizer / Auditor / Advisor / Patroller 是同一产品的组件与交付形态，不是彼此独立的产品。 / PawSQL is a single product: Cloud is the public deployment form, while Engine / Optimizer / Auditor / Advisor / Patroller are components and delivery forms of the same product, not separate products.
> 术语以站内术语表为准：SQL 审核对应英文 SQL Review，查询重写对应 Query Rewrite，索引推荐对应 Index Recommendation；英文内容统一用 Review，不用 Audit。 / Use the site glossary for terminology: 审核 is SQL Review, 重写 is Query Rewrite, 索引推荐 is Index Recommendation; English content uses Review, never Audit.
> 引用能力范围或版本支持时以对应页面为准；标注 unknown、或 status 非 published 的内容表示尚未经产品核实，不应作为事实引用。 / Cite capability scope and version support from the corresponding page; content marked unknown, or with a status other than published, is not yet product-verified and must not be cited as fact.

# Prerequisites and Security

> Prepare PawSQL, review context, platform permissions, network paths, credentials, and data controls before connecting a repository or pipeline.

Before a production rollout, the PawSQL administrator, DevOps owner, and database owner should approve service access, authorization, data boundaries, and acceptance criteria.

## Goal

Prepare PawSQL, review context, platform permissions, network paths, credentials, and data controls before connecting a repository or pipeline.

## Prerequisites

Involve the PawSQL administrator, DevOps owner, and database owner before a production rollout.

## Steps

Prepare the PawSQL and engineering-platform resources, validate the network paths, apply identity and least privilege, and set data handling controls, then run the acceptance cases and readiness checklist.

## PawSQL resources

* A reachable PawSQL Cloud or PawSQL Server endpoint
* A dedicated integration identity rather than a personal administrator account
* The target organization and project
* A workspace that matches the target database engine and version
* A published review policy and gate thresholds
* Least-privilege access to create reviews, query status, and open reports

## Engineering-platform resources

* Permission to configure connectors, webhooks, pipelines, or repository variables
* A defined set of repositories, branches, and events
* Rules for SQL paths, extensions, encoding, and migration formats
* Secret storage that masks credentials in logs
* A destination for commit status, review checks, pipeline status, or reports

## Network paths

| Direction                 | Validate                                                      |
| ------------------------- | ------------------------------------------------------------- |
| Repository to PawSQL      | Connector access, webhook endpoint, port, and TLS             |
| Pipeline runner to PawSQL | DNS, proxy, firewall, timeout, and request size               |
| User browser to PawSQL    | Report access, authentication, and project authorization      |
| PawSQL to database        | Connectivity required for live metadata, plans, or validation |

## Identity and least privilege

* Use independently revocable credentials for each platform, environment, or project.
* Limit PawSQL credentials to the intended project and review operations.
* Grant repository credentials only the source-read and status-write scopes required.
* Prefer read-only database access where live context is necessary.
* Separate test and production identities and define expiration, rotation, and emergency revocation.
* Never store plaintext credentials in source, pipeline definitions, logs, screenshots, or tickets.

## Data handling

| Data                        | Recommended control                                             |
| --------------------------- | --------------------------------------------------------------- |
| SQL and migration scripts   | Apply source-code and business-data classification              |
| DDL and metadata            | Restrict movement across network boundaries                     |
| Database connection details | Use secure storage and redact complete connection strings       |
| Review reports              | Inherit PawSQL project access and apply a retention period      |
| Pipeline logs               | Redact tokens, passwords, literals, and sensitive error context |

## Acceptance cases

Test a passing change, a predictable blocking violation, a commit with no SQL, an invalid workspace or credential, a timeout or service failure, and a duplicate event or retry.

## Readiness checklist

* [ ] The connector or runner can reach PawSQL.
* [ ] Repository, branch, workspace, and policy mappings are correct.
* [ ] Secret masking, rotation, and revocation are operational.
* [ ] Pass, block, skip, timeout, and failure behavior are verified.
* [ ] Reports are restricted to authorized users.
* [ ] Owners are assigned for the integration and review policy.

## Next step

Configure the [SQL quality gate and feedback](/en/user-guide/cicd/pipeline-gate), then set up a prebuilt connector or OpenAPI workflow.