A immediate is just not a permission system
It’s tempting so as to add “solely present my territory” to the system immediate and transfer on. I perceive the enchantment. However a immediate is a suggestion, and the mannequin can ignore it, neglect it, or misinterpret it on a tough query. A greater setup parses the generated SQL and rewrites it earlier than something runs, so the principles reside in code that the mannequin can’t discuss its manner round. Within the benchmark behind this work, the most typical repair throughout 900 check queries was including a row filter to the WHERE clause (285 occasions). Column masking got here subsequent (240), adopted by scope restriction (165).
Sure or no is never the actual reply
Most actual questions don’t match neatly into enable or deny. In the identical 900 queries, 40% may run unchanged. One other 20% wanted a row filter, 15% wanted column masking, and 11.7% wanted a be a part of rewrite. Round 6.7% went to a human reviewer, and one other 6.7% had been blocked. Most individuals nonetheless acquired a helpful reply. It was only a safer one, and I feel that commerce is the best one to make.
Examine earlier than it runs, and maintain the account small
Validate each question earlier than it executes. Reject SELECT *, pulls that cross scope boundaries, outsized end result units, and dangerous joins. Then ship every thing by way of a gateway that connects with a slender database account. That manner, a immediate injection or a foul technology can’t stroll round your guidelines, even when the mannequin will get inventive.
