Data Classification with Agents

The OLTP Classification Agent is a container you run in your own environment to scan your OLTP databases for classification. Deploying it involves configuring a credential provider, network and transport setup, and a cron schedule. For what the agent classifies and how sampled data is handled, see OLTP Classification Agent.

Prerequisites

Before deploying the agent:

• The target database is registered as a repository in ALTR.
• A repository service user credential is available in one of the credential providers below. A repository service user is a read-only database credential used only by agents — distinct from the repository users the sidecar uses for impersonation.
• The environment running the agent container has outbound connectivity to both the target database and ALTR’s SaaS control plane.

Registering an Agent and Creating Tasks

To register the classification agent:

1. Log in to ALTR through your identity provider (IdP).
2. Select Data Configuration > Agents in the navigation menu.
3. Click Register Agent.
4. Enter a Name for the agent.
5. Select Classification Agent as the Agent Type.
6. Enter the agent’s Public Key.
7. Click Register Agent.

To create a classification task:

1. From the agent’s detail view, click New Task.
2. Enter a Name for the task.
3. Select the Repo Name, then select the Classification Method.
4. Select the Collection.
5. Select the Service User — the repository service user credential the agent uses to connect.
6. Enter the Task Schedule as a cron expression, and select a Time Zone.
7. Click Create Task.

Deploying the agent container itself is a separate step from registering the agent and creating tasks in ALTR. Contact ALTR Support for container deployment guidance.

Credential Providers

The agent retrieves the repository service user’s credentials at runtime from a configured credential provider. Four providers are supported:

Provider	Rotation behavior
AWS Secrets Manager	Update the credential in the vault. The agent picks up the new value on its next retrieval — no container restart required.
Azure Key Vault	Update the credential in the vault. The agent picks up the new value on its next retrieval — no container restart required.
Environment Variable	Requires a container restart to pick up a new value.
Local File	Update the file on disk. The agent detects the change and picks up the new value automatically — no container restart required.

Note

AWS Secrets Manager and Azure Key Vault support plaintext secret values only. Formatted secret objects — such as AWS Secrets Manager’s structured RDS-style JSON secrets, with username, password, host, and port fields — aren’t supported for either provider. Store the repository service user’s credential as a plaintext value in the vault.

SSL/TLS Support

The agent supports SSL/TLS for its connection to the target database.

Cron Scheduling

The agent runs classification jobs on a cron schedule you configure, so classification can run on a recurring basis without manual intervention. OLTP is the only ALTR data source with recurring, scheduled classification — Snowflake and Databricks classification jobs run on demand only.

Database-Specific Sampling

Each database type uses its own sampling mechanism. Oracle and PostgreSQL support block-level sampling. MySQL requires a full table scan for sampling, which affects classification performance on large MySQL tables.

Classification Conditions

The agent runs ALTR Native classification. A classifier’s Google DLP condition uses your own Google Cloud credentials. See Google DLP Conditions for how OLTP’s Google DLP access differs from Snowflake and Databricks.