API-First Data Access
One owner per dataset · everyone else on a contract · roadmap item 30
Applications reach directly into databases they do not own. An application that needs an order opens a connection to the orders database and runs SQL against its tables. It works, and it is why nothing about those tables can change.
The replacement is not "add APIs". It is a rule about who may write what, with an API as the consequence: each dataset has exactly one owning service, and every other application goes through that service's contract. The migration is finished for a dataset when the direct grant is revoked — not when the API is published.
What this costs today
Each of these is worked through with a scenario on the next page.
| Cost | The short version | |
|---|---|---|
| 01 | The schema is the public API | A column cannot be renamed without finding every reader first, so it is not renamed. |
| 02 | Authorization is table-shaped | A credential grants a table, not an operation, and the audit trail names a connection, not a caller. |
| 03 | The coupling is invisible | Nothing can answer "what breaks if this table breaks". |
| 04 | Connections scale with instances | Every replica opens its own pool straight to the database — and item 26 is about to make replica count elastic. |
| 05 | It blocks the platform underneath | Item 06 cannot change replication and item 27 cannot make a site independent while the reader set is unknown. |
What is defined here
| Page | Question |
|---|---|
| 02 · Why not direct | What does direct access actually cost? |
| 03 · Ownership | What does owner mean, and who decides? |
| 04 · The contract | What is a contract, and what counts as a breaking change? |
| 05 · Migration | How does a dataset move across, and when is it done? |
The direction behind this is roadmap item 30 on the Platform Roadmap; the dated work is in the application modernization milestones.