How the Platform Accesses Your Instance

Last updated: July 28, 2026

Your AkasicDB Playground instance is single-tenant, but the platform does connect to it to provide service features. This page discloses every such path and the privilege scope of each.

Access paths at a glance

Path	Account (role)	Privilege scope	When it runs
Studio (web dashboard)	`supabase_admin`	Full instance administration	When you use Studio (requires your session)
Query statistics collection	`controlplane_monitor`	Statistics views only — no access to table data	Periodically (about every 5 minutes, automatic)
MCP `execute_sql`	`controlplane_mcp`	Same as the `postgres` role (your privileges)	Only when you, the owner, invoke the MCP tool

This is why you will see roles named controlplane_monitor and controlplane_mcp in your instance's pg_roles (\du). Neither role is a superuser.

What each role does

`controlplane_monitor` — query statistics collection

Holds only PostgreSQL's built-in pg_monitor privileges: it can read statistics views (pg_stat_statements and friends) and cannot read data in your tables.
The platform connects as this role roughly every 5 minutes and collects the parameterized shape of queries (constants and parameter values stripped), call counts, and execution times. The actual values inside your queries are not collected.
The statistics are used to operate and improve the Service, and only the latest snapshot is retained. See Section 2 of the Privacy Policy for details.

`controlplane_mcp` — MCP SQL execution

A member of the postgres role, so its privilege ceiling equals yours.
Used only when you, the instance owner, ask an MCP client (such as Claude) to run SQL. Sessions run SET ROLE postgres, so objects you create are owned by postgres exactly as usual.
The platform never runs queries through this role without your request.

Authentication: there is no password

Neither role has a password; the platform authenticates with certificates only (mTLS). This means:

No platform password is stored for your instance — there is no password to leak.
Changing your postgres password does not affect platform features.
On every connection the platform also verifies the instance's server certificate, confirming it reached the intended instance.

At the network level this path is reachable only from inside the platform (the control plane); it is never exposed to the internet.

What happens if you drop the roles?

You can drop or alter these roles inside your instance — we do not prevent it. The consequences:

Dropping controlplane_monitor → query statistics collection stops for your instance.
Dropping controlplane_mcp (or revoking its postgres membership) → MCP integration features such as execute_sql stop working.

Re-provisioning the instance restores the roles.

Unsupported changes

Changing the password directly with ALTER USER postgres PASSWORD ... (for example in Studio's SQL editor) is an unsupported path. Platform features keep working thanks to the certificate-based authentication above, but the password shown in your dashboard's connection string will no longer match reality.

Contact: privacy@graphai.io