Cockroach Labs

Published on August 28, 2026 | 0 minute read Database identity lifecycle management must extend beyond authentication: access should be provisioned, synchronized, audited, and safely removed from the same external identity source. CockroachDB provides these controls natively in SQL for LDAP, JWT, and OIDC users. Just-in-time provisioning creates SQL users only after verified first login. IdP group changes sync to database role memberships at every successful login.

Banking has become an always-on business. Customers expect instant payments, accurate balances, and continuous access to financial services, while banks face increasingly demanding resilience and regulatory requirements. Temenos and Cockroach Labs are addressing these demands by running Temenos Core on CockroachDB, combining cloud-native core banking capabilities with a distributed SQL database designed for resilient, scalable transaction processing.

In April 2025, Google released a protocol for agent-to-agent communication. Within three months, Google had donated it to the Linux Foundation, where AWS, Cisco, Microsoft, Salesforce, SAP, and ServiceNow signed on to govern it. By December, Anthropic and OpenAI had put MCP and AGENTS.md under the same roof through the Agentic AI Foundation. Azure, Amazon Bedrock AgentCore, and Google Cloud have integrated A2A natively, and more than 150 organizations now support it.

Most SaaS teams shipping agentic features focus on prompt safety and API-layer filtering. But effective AI agent security also depends on controlling what data an agent can access when those application-layer defenses fail. Your company is building agents that read, reason, and act on behalf of customers.

For self-hosted organizations running Kubernetes, StatefulSets are powerful, but they aren't CockroachDB-aware. They don't know how to decommission a node safely, manage a multi-region topology, or make rolling upgrade decisions with the cluster's health in mind. The result is operational glue: scripts, manual upgrade sequences, certificate rotations and work that has to be re-run every time there’s changes.

Financial AI agents operating under DORA, the EU AI Act, and GDPR need infrastructure that supports operational resilience, traceability, and reliable transaction processing.

When builders ship AI-powered applications, the data layer quietly becomes the hardest part of the stack. What starts as a single PostgreSQL instance grows into a composite architecture: PostgreSQL for transactions, Redis for caching and session state, and a dedicated vector database like Pinecone or Weaviate for embeddings and similarity search. Each system adds complexity with its own connection pools, backup strategies, security perimeters, failover runbooks, and on-call expertise.

The agent your team just shipped to external users has the ability to read customer records, execute transactions, and call external APIs. In most deployments today, it’s running under a shared service account (the same non-human identity used by multiple applications or agents) with permissions far broader than any individual task requires, no formal identity of its own, and no audit trail that can answer what it actually accessed or why.

“Consolidating onto CockroachDB meant we could build our entire AI platform on infrastructure we already trusted. We didn’t need another vendor, another contract, or another compliance audit.” — Garrett Browne, CTO, BetterTracker Based in Maryland, BetterTracker is an AI-powered business optimization platform and digital ecosystem built to help MSPs and SMBs gain complete visibility into their technology, vendors, contracts, subscriptions, expenses, and shadow IT.

We're proud to announce that the Center for Internet Security (CIS) has published the CIS CockroachDB v25.x Benchmark, a comprehensive, consensus-driven security configuration guide for self-hosted CockroachDB deployments. This is a meaningful milestone for CockroachDB and for the organizations that run it in production.