All Products
Search

This Product

    Data Management:Control modes

    Document Center

    Data Management:Control modes

    Last Updated:Mar 28, 2026

    Data Management (DMS) provides three control modes — Flexible Management, Stable Change, and Security Collaboration — to govern how database instances are accessed, changed, and audited. Assign a control mode to each instance based on your team size, security requirements, and change governance needs.

    Choose a control mode

    The three modes are ordered from lowest to highest in terms of security level, governance over R&D and change processes, team scale, feature breadth, and cost.

    Control modeBest forBilling
    Flexible ManagementSingle-user or low-governance environments where tickets don't require approvalFree
    Stable ChangeSmall teams requiring high availability, lock-free changes, and SQL reviewPaid (subscription or pay-as-you-go)
    Security CollaborationLarge teams requiring enterprise-grade security, compliance, and customizable DevOps workflowsPaid (subscription or pay-as-you-go)

    Flexible Management supports visualized data and schema management for 30+ database types. Run SQL statements or use point-and-click operations directly on the SQL Console. Data management features have some limits.

    Stable Change includes everything in Flexible Management, with relaxed feature limits and additional stability tools such as lock-free changes and SQL review.

    Security Collaboration includes everything in Flexible Management and Stable Change, plus the DevOps feature for customizing design specifications, R&D processes, and approval workflows.

    For pricing details, see Billable items and prices and Purchase the DMS service.

    Configure the control mode of an instance

    Features supported by each control mode

    Category

    Product Features

    Flexible Management

    Stable Change

    Security Collaboration

    Instance management

    Log on to a database

    Database account and password

    Note

    If security hosting is enabled for the instance, an account password is not required. For more information, see Enable security hosting.

    Alibaba Cloud account authentication. Database accounts and passwords are not used.

    Sync data dictionary

    Y

    Y

    Y

    Manage instance permissions

    N

    Note

    If security hosting is enabled for the instance, you can manage instance permissions. For more information, see Enable security hosting.

    Y

    IP address whitelist for access

    Y

    Yes, individual configuration is required.

    Y: Can be enabled globally. Access can be restricted to office networks.

    Set metadata access control

    N

    N

    Y

    Resource authorization granularity

    Instance authorization and database account access.

    Note

    If security hosting is enabled for the instance, database, table, field, and row-level permissions are supported. For more information, see Enable security hosting.

    On-demand database, table, field, and row-level permissions.

    Operation authorization granularity

    -

    Feature authorization

    Query, export, and change permissions.

    Authorization period

    -

    -

    Define as needed. Permissions are automatically revoked upon expiration.

    Row-level data permission management

    N

    N

    Y

    Data export

    Export SQL result set

    Y

    Y

    Y

    Database export

    Y

    Y

    Y

    Permission verification and approval workflow

    -

    -

    Y

    Maximum number of rows that can be exported for free per day

    1 million rows

    20 million rows

    Unlimited

    Maximum number of tables that can be exported at a time

    Unlimited

    Unlimited

    Unlimited

    Maximum capacity of tables that can be exported at a time

    10 GB

    Unlimited

    Unlimited

    Security and specifications

    Operation audit

    Y: View log data from the last 24 hours.

    Y: Access and view log data at any time within the 3-year retention period.

    Data watermark

    Y

    Y

    Y

    Manage sensitive data

    Y: Paid feature. Fine-grained access control is not supported.

    Y: Paid feature. Fine-grained access control is not supported.

    Y: Paid feature. Included in sensitive data management.

    Create security rules

    N

    N

    Y

    Database clone

    Y

    Y

    N

    Data classification and categorization

    Y: Paid feature. Included in sensitive data management.

    Y: Paid feature. Included in sensitive data management.

    Y: Paid feature. Included in sensitive data management.

    Schema evolution

    Schema design

    N

    N

    Y

    Schema synchronization

    Y

    Y

    Y

    Shadow table synchronization

    Y

    Y

    Y

    Lock-free DDL change

    N

    Y

    Y

    Data change

    Common data change

    N

    Y

    Y

    Lock-free DML change

    N

    Y

    Y

    Historical data cleanup

    N

    Y

    Y

    Programmable object

    Y

    Y

    Y

    Data import

    Y

    Y

    Y

    Pre-change threat identification

    N

    Y

    Y

    Post-change threat management

    N

    Y

    Y

    Database stability

    Data tracking

    Binlog files from the last hour.

    Unlimited. Batch download is supported.

    Unlimited. Batch download is supported.

    SQL review

    Y: Supports setting audit rules. Approval workflows are not supported.

    Y: Supports setting audit rules. Approval workflows are not supported.

    Y: Supports setting audit rules and approval workflows.

    Operations management

    Database group

    N

    N

    Y

    Metadata access control

    N

    N

    Y

    Development efficiency

    Collaborative development

    N

    N

    Y

    Cross-instance query

    N

    N

    Y

    Automatic generation of test data

    Y: Generate up to 1 million rows at a time.

    Y: Generate up to 100 million rows at a time.

    Y: Generate up to 100 million rows at a time.

    Development workflow approval

    N

    N

    Y: Supports customization as needed.

    Configure logical databases

    N

    N

    Y

    Batch operations on tables

    Y

    Y

    Y

    Scheduling of auto-triggered data development tasks

    N

    N

    Y

    SQL window

    Query and change table schemas

    Y

    -

    Y

    Super SQL mode

    N

    Note

    If security hosting is enabled for the instance, Super SQL mode is supported. For more information, see Enable security hosting.

    Y

    Y

    Manage table schema versions

    Y

    Y

    Y

    Adjust field sensitivity levels

    Y

    Y

    Y

    Monitor data quality

    N

    N

    Y

    Cross-database query

    Y

    Y

    Y: Supported after you enable the cross-database query feature.

    Database performance diagnosis and optimization

    Y

    Y

    Y

    SQL command

    Y

    Y

    Y

    Copy SQL result set

    Y

    Y

    Y

    Execution plan

    Y

    Y

    Y

    Character set switch

    Y

    Y

    Y

    Query SQL timeout and interruption

    N

    N

    Y

    Daily query row limit

    N

    N

    Y

    Daily query count limit

    N

    N

    Y

    Save frequently used SQL

    Y

    Y

    Y

    Large table full table scan limit

    N

    N

    Y

    Maximum number of rows returned for a single query

    3,000 rows. Pagination is supported.

    3,000 rows. Pagination is supported.

    3,000 rows. Customizable. You can configure whether to use pagination.

    Visualization of data query results

    Y

    Y

    Y

    SQL formatting

    Y

    Y

    Y

    SQL code hinting

    Y

    Y

    Y

    Table schema management

    Table schema comparison

    Y

    Y

    Y

    Table schema editing

    Y

    Y

    Y

    Table schema synchronization

    Y

    Y

    Y

    Data dictionary export

    5

    Unlimited

    Unlimited

    Table schema design specifications

    N

    N

    Y

    Table schema development workflow

    N

    N

    Supports cross-account, cross-database, and self-managed databases.

    Manage table schema versions

    Retain up to 3 database versions.

    Retain up to 20 database versions.

    Retain up to 50 database versions.

    Code generator

    N

    N

    Y

    Sync data dictionary

    N

    N

    Y

    Topology

    -

    -

    Y

    Instance management

    FeatureFlexible ManagementStable ChangeSecurity Collaboration
    Instance logonDatabase account and password required ¹Password-free logon via Alibaba Cloud accountPassword-free logon via Alibaba Cloud account
    Data dictionary synchronizationYYY
    Instance permission managementN ¹YY
    Access IP whitelistYY — source IPs controlled individuallyY — globally enabled over office networks only
    Metadata access controlNNY
    Resource authorization granularityDatabase account level ¹Databases, tables, columns, and rowsDatabases, tables, columns, and rows
    Operation authorization granularity—Feature-levelQuery, export, change, and design operations per table
    Authorization period——Customizable; permissions auto-revoked on expiry
    Row-level data permission managementNNY

    ¹ If security hosting is enabled, database accounts and passwords are not required for logon, instance permission management is supported, and resource authorization granularity extends to databases, tables, columns, and rows. See Enable security hosting.

    Data export

    FeatureFlexible ManagementStable ChangeSecurity Collaboration
    SQL result set exportYYY
    Database exportYYY
    Permission verification and process approval——Y
    Max rows exported for free per day1 million20 millionUnlimited
    Max tables per exportUnlimitedUnlimitedUnlimited
    Max capacity per export10 GBUnlimitedUnlimited

    Security and specifications

    FeatureFlexible ManagementStable ChangeSecurity Collaboration
    Operation auditPrevious day's logs onlyLogs retained for 3 years, accessible anytimeLogs retained for 3 years, accessible anytime
    Data watermarkYYY
    Sensitive data managementY — charged; fine-grained permission management not supportedY — charged; fine-grained permission management not supportedY — charged; enable in the Sensitive Data module
    Security rule managementNNY
    Database cloneYYN
    Data classificationY — charged; enable in the Sensitive Data moduleY — charged; enable in the Sensitive Data moduleY — charged; enable in the Sensitive Data module

    Schema change

    FeatureFlexible ManagementStable ChangeSecurity Collaboration
    Schema designNNY
    Schema synchronizationYYY
    Shadow table synchronizationYYY
    Lock-free DDL operationsNYY

    Data change

    FeatureFlexible ManagementStable ChangeSecurity Collaboration
    Normal data changeNYY
    Lock-free DML operationsNYY
    Historical data deletionNYY
    Programmable object changeYYY
    Data importYYY
    Risk identification before changesNYY
    Risk management after changesNYY

    Database stability

    FeatureFlexible ManagementStable ChangeSecurity Collaboration
    Data trackingBinary logs from the previous 1 hour onlyUnlimited; batch download supportedUnlimited; batch download supported
    SQL reviewReview rule configuration supported; process approvals not supportedReview rule configuration supported; process approvals not supportedReview rule configuration and process approvals supported

    O&M management

    FeatureFlexible ManagementStable ChangeSecurity Collaboration
    Database groupingNNY
    Metadata access controlNNY

    R&D efficiency

    FeatureFlexible ManagementStable ChangeSecurity Collaboration
    Collaborative R&DNNY
    Cross-instance queryNNY
    Automatic test data generationMax 1 million rowsMax 100 million rowsMax 100 million rows
    R&D process approvalNNY — customizable approval workflows
    Logical database configurationNNY
    Operations on multiple tablesYYY
    Scheduling recurring data development tasksNNY

    SQL Console

    FeatureFlexible ManagementStable ChangeSecurity Collaboration
    Schema query and changeY—Y
    Super SQL modeN ²YY
    Schema version managementYYY
    Field sensitivity level adjustmentYYY
    Data quality checkNNY
    Cross-database queryYYY — requires cross-database query feature to be enabled
    Database performance diagnosis and optimizationYYY
    SQL statementsYYY
    SQL result set copiesYYY
    Execution plansYYY
    Character set changeYYY
    SQL query timeout and interruptionNNY
    Daily query row limitNNY
    Daily query count limitNNY
    Frequently used SQL statement managementYYY
    Full-table scan table size thresholdNNY
    Max rows returned per query3,000 rows; pagination supported3,000 rows; pagination supported3,000 rows; pagination optional
    Visualization of query resultsYYY
    SQL formattingYYY
    Intelligent SQL promptsYYY

    ² If security hosting is enabled, Super SQL mode is supported. See Enable security hosting.

    Schema management

    FeatureFlexible ManagementStable ChangeSecurity Collaboration
    Schema comparisonYYY
    Schema editingYYY
    Table schema synchronizationYYY
    Max data dictionaries exported5UnlimitedUnlimited
    Table schema design specificationsNNY
    R&D process for table schemasNNTables created by other accounts, in other databases, and in self-managed databases
    Schema version management3 versions retained20 versions retained50 versions retained
    Code generatorNNY
    Data dictionary synchronizationNNY
    Topology——Y

    Legend: Y = supported, N = not supported, — = not applicable

    FAQ

    Can multiple instances share the same Security Collaboration quota?

    Yes, but not at the same time. After DMS completes data or schema changes on an instance in Security Collaboration mode, the DMS administrator or DBA can switch that instance back to Flexible Management, then switch another instance to Security Collaboration.

    Can I run UPDATE or DELETE statements directly on the SQL Console for Stable Change instances?

    No. Direct data modification via the SQL Console is not supported for instances in Stable Change mode. Submit a ticket instead. See Lock-free data changes and Lock-free schema changes.

    Can I switch a paid instance back to its original control mode?

    Yes. See Change the control mode of an instance.