@weave-kit/engine 1.4.0 → 1.6.0

package/dist/runtime/data-access/query.js

@@ -1,21 +1,24 @@
-import { SchemaError, METRIC_NAMES, primaryFieldsOf, encodeRecordKey, decodeRecordKey, canonicalizePrimaryValue, principalActorId } from '../../core/index.js';
+import { SchemaError, METRIC_NAMES, isSafeRlsRole, primaryFieldsOf, encodeRecordKey, decodeRecordKey, canonicalizePrimaryValue, principalActorId } from '../../core/index.js';
 import { DETAILS_COLUMNS, FIELD_TYPES, isSideTableVirtualField, RECORD_META_ID_FIELD, recordKeySql, recordMetaTableName, scopeFieldName } from '../../core/index.js';
 import { AUDIT_ACTOR_TYPES, DATA_ACTIONS } from '../../core/audit/index.js';
 import { NOOP_SCRIPT_DISPATCHER, SCRIPT_HOOKS } from '../../core/index.js';
 import { evaluateTransition } from '../tools/policies.js';
-import { buildCountSql, buildFindSql, resolvePagination, scopeSuffix } from './builder.js';
+import { buildCountSql, buildEstimateSql, buildFindSql, resolvePagination, scopeSuffix } from './builder.js';
 import { deleteDetailsChildren, insertDetails } from './details.js';
 import { insertLinks, replaceLinks } from './link.js';
-import { runWorkflowTransition, getWorkflowStatus, acquireWorkflowLock, releaseWorkflowLock, getWorkflowHistory, getWorkflowTodos, overrideWorkflow, } from './workflow.js';
+import { WORKFLOW_ACTIONS, runWorkflowTransition, getWorkflowStatus, acquireWorkflowLock, releaseWorkflowLock, getWorkflowHistory, getWorkflowTodos, overrideWorkflow, } from './workflow.js';
 import { computeFormulas } from './formula.js';
 import { generateSeqNo } from './seqno.js';
 import { subjectOf, scopeOf } from './types.js';
 import { validateRecord } from './validate.js';
-import { FILTER_OPS, SORT_DIRS, WRITE_MODES } from './values.js';
+import { FILTER_OPS, SORT_DIRS, TOTAL_MODES, WRITE_MODES } from './values.js';
 import { decodeCursor, encodeCursor } from './cursor.js';
 import { QUERY_BUDGET_DEFAULTS, assertQueryBudget } from './query-budget.js';
-import { EXECUTION_OUTCOMES, EXECUTION_STAGES } from '../../core/index.js';
+import { EXECUTION_OUTCOMES } from '../../core/index.js';
+import { runPipeline } from '../execution/index.js';
 import { upsertRecordMeta, deleteRecordMeta } from '../record-meta/index.js';
+import { SYSTEM_TABLES } from '../../core/storage/system-tables.js';
+import { asRlsRole } from './rls-session.js';
 const q = (id) => `"${id}"`;
 /** cross-object formula authorization derived from the request context */
 function formulaAuth(ctx) {
@@ -168,6 +171,11 @@ function pkValuesOf(def, id, ctx) {
     }
     return values;
 }
+/** reject a malformed external id up front (keyed objects only; key-less objects 404 later) */
+function validateId(def, id, ctx) {
+    if (primaryNames(def).length > 0)
+        pkValuesOf(def, id, ctx);
+}
 /** primary-key filter object for `find` (declared names zipped with values) */
 function pkFilter(def, values) {
     const filter = {};
@@ -264,6 +272,10 @@ export class DefaultObjectDataAccess {
     schemaRevision;
     /** optional metrics sink (query-budget rejections); absent = zero overhead */
     metrics;
+    /** object-path RLS role (`rls.enforce`); user-principal customer-table reads/updates/deletes run under it */
+    rlsRole;
+    /** default `total` computation for `find` (per-call `opts.total` overrides) */
+    totalMode;
     constructor(options = {}) {
         this.audit = options.audit;
         this.script = options.script ?? NOOP_SCRIPT_DISPATCHER;
@@ -276,6 +288,43 @@ export class DefaultObjectDataAccess {
         this.evidence = options.evidence;
         this.schemaRevision = options.schemaRevision;
         this.metrics = options.metrics;
+        if (options.rls !== undefined && !isSafeRlsRole(options.rls.role)) {
+            throw new Error(`invalid RLS role name "${options.rls.role}"`);
+        }
+        this.rlsRole = options.rls?.role;
+        this.totalMode = options.total ?? TOTAL_MODES.EXACT;
+    }
+    /**
+     * Run customer-table statements under the object RLS role for a user
+     * principal (a pool request gets its own short transaction); system
+     * principals and enforcement-off run as the owner.
+     */
+    async readScoped(ctx, fn) {
+        const subject = this.rlsRole === undefined ? undefined : subjectOf(ctx);
+        if (subject === undefined)
+            return fn(ctx.client ?? ctx.pool);
+        const role = this.rlsRole;
+        if (ctx.client !== undefined)
+            return asRlsRole(ctx.client, role, subject, () => fn(ctx.client));
+        const client = await ctx.pool.connect();
+        try {
+            await client.query('BEGIN');
+            const result = await asRlsRole(client, role, subject, () => fn(client));
+            await client.query('COMMIT');
+            return result;
+        }
+        catch (error) {
+            await client.query('ROLLBACK').catch(() => { });
+            throw error;
+        }
+        finally {
+            client.release();
+        }
+    }
+    /** {@link readScoped} for a client already inside the write transaction */
+    underRls(client, ctx, fn) {
+        const subject = this.rlsRole === undefined ? undefined : subjectOf(ctx);
+        return subject === undefined ? fn() : asRlsRole(client, this.rlsRole, subject, fn);
     }
     /**
      * Run the read hook (`onLoad`) over a fetched batch. The hook receives the
@@ -353,9 +402,9 @@ export class DefaultObjectDataAccess {
     }
     async find(objectName, opts, ctx) {
         const def = requireDef(ctx, objectName);
-        const q = ctx.client ?? ctx.pool;
         const pks = primaryFieldsOf(def);
         const budget = ctx.budget ?? this.budget;
+        const totalMode = opts.total ?? this.totalMode;
         try {
             assertQueryBudget(opts, budget, ctx.locale);
         }
@@ -369,6 +418,21 @@ export class DefaultObjectDataAccess {
             throw error;
         }
         const { limit } = resolvePagination(opts, budget.maxRows);
+        const noneTotal = totalMode === TOTAL_MODES.NONE;
+        // `total` per the effective mode: exact COUNT(*), a reltuples estimate, or
+        // nothing (none). Counts run on the same (RLS-scoped) connection as the page.
+        const countTotal = async (db, buildCtx) => {
+            if (noneTotal)
+                return undefined;
+            if (totalMode === TOTAL_MODES.ESTIMATE) {
+                const { sql, params } = buildEstimateSql(def);
+                const { rows } = await runTableQuery(db, objectName, sql, params, ctx.locale);
+                return rows[0]?.total;
+            }
+            const { sql, params } = buildCountSql(def, opts, buildCtx, ctx.rowScope);
+            const { rows } = await runTableQuery(db, objectName, sql, params, ctx.locale);
+            return rows[0].total;
+        };
         // keyset cursor (single primary key): `pk > cursor` ordered by pk. A
         // caller-provided sort is ignored in cursor mode (documented) so pages
         // traverse one deterministic sequence.
@@ -385,17 +449,18 @@ export class DefaultObjectDataAccess {
             const meta = needsSideTable(pageOpts) ? { table: recordMetaTableName(def.name) } : undefined;
             const buildCtx = { ...bctx(ctx, objectName), ...(meta === undefined ? {} : { meta }) };
             const { sql, params } = buildFindSql(def, pageOpts, buildCtx, ctx.rowScope, pageOpts.exclude, undefined, budget.maxRows + 1);
-            const { rows } = await runTableQuery(q, objectName, sql, params, ctx.locale);
+            const [{ rows }, total] = await this.readScoped(ctx, async (db) => [
+                await runTableQuery(db, objectName, sql, params, ctx.locale),
+                await countTotal(db, buildCtx),
+            ]);
             const hasMore = rows.length > limit;
             const pageRows = hasMore ? rows.slice(0, limit) : rows;
             const last = pageRows[pageRows.length - 1];
             const nextCursor = hasMore && last !== undefined ? encodeCursor([last[pkName]]) : undefined;
-            const { sql: countSql, params: countParams } = buildCountSql(def, opts, buildCtx, ctx.rowScope);
-            const { rows: countRows } = await runTableQuery(q, objectName, countSql, countParams, ctx.locale);
             const loaded = await this.runOnLoad(objectName, pageRows, ctx);
             return {
                 rows: loaded,
-                total: countRows[0].total,
+                ...(total === undefined ? {} : { total }),
                 hasMore,
                 ...(nextCursor === undefined ? {} : { nextCursor }),
             };
@@ -404,13 +469,19 @@ export class DefaultObjectDataAccess {
         // LEFT JOIN it and select/filter/sort them in SQL (never customer columns)
         const meta = needsSideTable(opts) ? { table: recordMetaTableName(def.name) } : undefined;
         const buildCtx = { ...bctx(ctx, objectName), ...(meta === undefined ? {} : { meta }) };
-        const { sql, params } = buildFindSql(def, opts, buildCtx, ctx.rowScope, opts.exclude, undefined, budget.maxRows);
-        const { rows } = await runTableQuery(q, objectName, sql, params, ctx.locale);
-        const { sql: countSql, params: countParams } = buildCountSql(def, opts, buildCtx, ctx.rowScope);
-        const { rows: countRows } = await runTableQuery(q, objectName, countSql, countParams, ctx.locale);
-        const total = countRows[0].total;
-        const loaded = await this.runOnLoad(objectName, rows, ctx);
-        return { rows: loaded, total, hasMore: (opts.offset ?? 0) + rows.length < total };
+        // with `total: 'none'` there is no count query to derive `hasMore`, so fetch
+        // one extra row (like cursor mode) and slice it off
+        const findOpts = noneTotal ? { ...opts, limit: limit + 1 } : opts;
+        const { sql, params } = buildFindSql(def, findOpts, buildCtx, ctx.rowScope, findOpts.exclude, undefined, noneTotal ? budget.maxRows + 1 : budget.maxRows);
+        const [{ rows }, total] = await this.readScoped(ctx, async (db) => [
+            await runTableQuery(db, objectName, sql, params, ctx.locale),
+            await countTotal(db, buildCtx),
+        ]);
+        const offset = opts.offset ?? 0;
+        const hasMore = noneTotal ? rows.length > limit : offset + rows.length < (total ?? 0);
+        const pageRows = noneTotal && hasMore ? rows.slice(0, limit) : rows;
+        const loaded = await this.runOnLoad(objectName, pageRows, ctx);
+        return { rows: loaded, ...(total === undefined ? {} : { total }), hasMore };
     }
     async findOne(objectName, id, ctx) {
         const def = requireDef(ctx, objectName);
@@ -425,22 +496,25 @@ export class DefaultObjectDataAccess {
         const result = await this.find(objectName, { filter: pkFilter(def, pkValuesOf(def, id, ctx)), limit: 1, fields: [...cols, RECORD_META_ID_FIELD] }, ctx);
         return result.rows[0] ?? null;
     }
-    /**
-     * Guardrail/approval gate for a data-access write (create/update/delete).
-     * Runs only when policies are configured (`policies=[]` → zero overhead) and
-     * is protocol-agnostic (action `object.<object>.<op>`), so REST / MCP /
-     * GraphQL / script writes are all covered from this single choke point.
-     * Deny throws; a `requiresApproval` policy throws with the approval key.
-     */
-    async guardWrite(op, objectName, ctx, args) {
-        if (this.policies.length === 0)
-            return;
-        const action = `object.${objectName}.${op}`;
+    /** pipeline context (actor/subject/correlation) for a governed write */
+    pipelineCtx(ctx) {
         const subject = subjectOf(ctx);
         const actorId = principalActorId(ctx.principal);
-        const guardrailCtx = {
+        const schemaRevision = ctx.schemaRevision ?? this.schemaRevision;
+        return {
             actor: { key: actorId, label: subject?.id ?? 'system', onBehalfOf: subject?.id ?? actorId },
             subject: subject ?? { id: 'system', roles: [] },
+            ...(ctx.requestId === undefined ? {} : { requestId: ctx.requestId }),
+            ...(ctx.traceId === undefined ? {} : { traceId: ctx.traceId }),
+            ...(schemaRevision === undefined ? {} : { schemaRevision }),
+            ...(ctx.locale === undefined ? {} : { locale: ctx.locale }),
+        };
+    }
+    /** guardrail + approval decision for `action` (shared by writes and transitions) */
+    async decide(action, args, ctx, pctx, requireApproval) {
+        const guardrailCtx = {
+            actor: pctx.actor,
+            subject: pctx.subject,
             action,
             args,
             dataAccess: toolDataAccessOver(this, {
@@ -451,55 +525,67 @@ export class DefaultObjectDataAccess {
                 ...(ctx.client === undefined ? {} : { client: ctx.client }),
             }),
         };
-        const gate = await evaluateTransition(this.policies, this.approvals, guardrailCtx, false);
-        if (this.evidence !== undefined) {
-            const now = new Date();
-            const schemaRevision = ctx.schemaRevision ?? this.schemaRevision;
-            const outcome = gate.kind === 'deny'
-                ? EXECUTION_OUTCOMES.DENY
-                : gate.kind === 'pending'
-                    ? EXECUTION_OUTCOMES.PENDING
-                    : EXECUTION_OUTCOMES.OK;
-            const stages = [
-                { stage: EXECUTION_STAGES.PLAN, outcome: EXECUTION_OUTCOMES.OK, at: now },
-                { stage: EXECUTION_STAGES.GUARDRAIL, outcome, at: now },
-                ...(gate.kind === 'pending'
-                    ? [{ stage: EXECUTION_STAGES.APPROVAL, outcome: EXECUTION_OUTCOMES.PENDING, at: now }]
-                    : []),
-            ];
-            void this.evidence
-                .record({
-                ...(ctx.requestId === undefined ? {} : { requestId: ctx.requestId }),
-                ...(ctx.traceId === undefined ? {} : { traceId: ctx.traceId }),
-                ...(schemaRevision === undefined ? {} : { schemaRevision }),
-                actor: guardrailCtx.actor,
-                ...(subject === undefined ? {} : { subjectId: subject.id }),
-                plan: { action, objectName, args },
-                stages,
-                ...(gate.kind === 'pending' ? { approvalKey: gate.approvalKey } : {}),
-                isError: gate.kind !== 'allow',
-                ...(gate.kind === 'deny'
-                    ? { errorCode: gate.code }
-                    : gate.kind === 'pending'
-                        ? { errorCode: 'mcp.approval.pending' }
-                        : {}),
-                timestamp: now,
-            })
-                .catch(() => { });
-        }
-        if (gate.kind === 'deny') {
-            throw new SchemaError(gate.code, { object: objectName, action, reason: gate.reason ?? '' }, ctx.locale);
-        }
-        if (gate.kind === 'pending') {
-            throw new SchemaError('object.action.pending', { object: objectName, action, approvalKey: gate.approvalKey }, ctx.locale);
+        const gate = await evaluateTransition(this.policies, this.approvals, guardrailCtx, requireApproval);
+        if (gate.kind === 'deny')
+            return { kind: 'deny', reason: gate.reason ?? '', errorCode: gate.code };
+        return gate;
+    }
+    /**
+     * Run a write (create/update/delete/transition) through the execution
+     * pipeline: guardrail/approval gate (when policies or `requireApproval` apply)
+     * → execute → one evidence row (when evidence is enabled). Protocol-agnostic
+     * (action `object.<object>.<op>` / `workflow.transition.<object>.<action>`),
+     * so REST / MCP / GraphQL / script writes share this single choke point.
+     * Without policies, approval or evidence the write runs directly.
+     */
+    async governed(plan, ctx, opts, execute) {
+        const gated = this.policies.length > 0 || opts.requireApproval !== undefined;
+        if (!gated && this.evidence === undefined)
+            return execute();
+        const reject = async (error) => {
+            await opts.onReject?.(error);
+            throw error;
+        };
+        if (opts.preflight !== undefined)
+            await opts.preflight().catch(reject);
+        const pctx = this.pipelineCtx(ctx);
+        const result = await runPipeline(plan, pctx, {
+            ...(gated
+                ? {
+                    gate: async () => this.decide(plan.action, plan.args, ctx, pctx, (await opts.requireApproval?.()) ?? false),
+                }
+                : {}),
+            execute,
+            ...(this.evidence === undefined ? {} : { evidence: this.evidence }),
+        });
+        const params = { object: plan.objectName ?? '', action: opts.actionParam ?? plan.action };
+        if (result.outcome === EXECUTION_OUTCOMES.OK)
+            return result.result;
+        if (result.outcome === EXECUTION_OUTCOMES.PENDING) {
+            return reject(new SchemaError(opts.pendingCode, { ...params, approvalKey: result.approvalKey ?? '' }, ctx.locale));
+        }
+        if (result.outcome === EXECUTION_OUTCOMES.DENY) {
+            return reject(new SchemaError((result.errorCode ?? 'mcp.policy.denied'), { ...params, reason: result.reason ?? '' }, ctx.locale));
         }
+        throw result.error;
     }
     async create(objectName, data, ctx) {
+        requireDef(ctx, objectName);
+        return this.governed({ action: `object.${objectName}.create`, objectName, args: data }, ctx, { pendingCode: 'object.action.pending' }, () => this.doCreate(objectName, data, ctx));
+    }
+    async update(objectName, id, changes, ctx) {
+        validateId(requireDef(ctx, objectName), id, ctx);
+        return this.governed({ action: `object.${objectName}.update`, objectName, objectId: id, args: changes }, ctx, { pendingCode: 'object.action.pending' }, () => this.doUpdate(objectName, id, changes, ctx));
+    }
+    async delete(objectName, id, ctx) {
+        validateId(requireDef(ctx, objectName), id, ctx);
+        return this.governed({ action: `object.${objectName}.delete`, objectName, objectId: id, args: {} }, ctx, { pendingCode: 'object.action.pending' }, () => this.doDelete(objectName, id, ctx));
+    }
+    async doCreate(objectName, data, ctx) {
         const def = requireDef(ctx, objectName);
         if (primaryNames(def).length === 0) {
             throw new SchemaError('data.recordNotFound', { object: objectName }, ctx.locale);
         }
-        await this.guardWrite('create', objectName, ctx, data);
         let client;
         let owned = false;
         if (ctx.client !== undefined) {
@@ -614,13 +700,12 @@ export class DefaultObjectDataAccess {
                 client.release();
         }
     }
-    async update(objectName, id, changes, ctx) {
+    async doUpdate(objectName, id, changes, ctx) {
         const def = requireDef(ctx, objectName);
         if (primaryNames(def).length === 0) {
             throw new SchemaError('data.recordNotFound', { object: objectName, id }, ctx.locale);
         }
         const pkValues = pkValuesOf(def, id, ctx);
-        await this.guardWrite('update', objectName, ctx, changes);
         let client;
         let owned = false;
         if (ctx.client !== undefined) {
@@ -636,7 +721,7 @@ export class DefaultObjectDataAccess {
                 await client.query('BEGIN');
             await validateRecord(def, changes, WRITE_MODES.UPDATE, { pool: client, registry: ctx.registry, locale: ctx.locale });
             const { sql, params } = buildFindSql(def, { filter: pkFilter(def, pkValues), limit: 1 }, bctx(ctx, objectName), ctx.rowScope, undefined, [recordKeySelect(def)]);
-            const { rows } = await runTableQuery(client, objectName, sql, params, ctx.locale);
+            const { rows } = await this.underRls(client, ctx, () => runTableQuery(client, objectName, sql, params, ctx.locale));
             const raw = rows[0];
             if (raw === undefined) {
                 throw new SchemaError('data.recordNotFound', { object: objectName, id }, ctx.locale);
@@ -692,7 +777,9 @@ export class DefaultObjectDataAccess {
                 const setSql = cols.map((c, i) => `${q(c)} = $${i + 1}`).join(', ');
                 const scope = ctx.rowScope !== undefined ? scopeSuffix(ctx.rowScope, cols.length + pkValues.length) : undefined;
                 const values = cols.map((c) => dbJsonValue(def.fields.find((f) => f.name === c), record[c] ?? null));
-                await runTableQuery(client, objectName, `UPDATE ${q(def.name)} SET ${setSql} WHERE ${pkWhereSql(def, cols.length + 1)}${scope !== undefined ? ` AND (${scope.sql})` : ''}`, [...values, ...pkValues, ...(scope?.params ?? [])], ctx.locale);
+                const res = await this.underRls(client, ctx, () => runTableQuery(client, objectName, `UPDATE ${q(def.name)} SET ${setSql} WHERE ${pkWhereSql(def, cols.length + 1)}${scope !== undefined ? ` AND (${scope.sql})` : ''}`, [...values, ...pkValues, ...(scope?.params ?? [])], ctx.locale));
+                if (res.rowCount === 0)
+                    throw new SchemaError('data.recordNotFound', { object: objectName, id }, ctx.locale);
             }
             await this.writeRecordMeta(client, def, metaKey, ctx, now, false);
             await replaceLinks(client, def, pkValues, payload, ctx.registry, ctx.locale);
@@ -731,13 +818,51 @@ export class DefaultObjectDataAccess {
      */
     async transition(objectName, id, action, ctx, payload) {
         const def = requireDef(ctx, objectName);
-        if (def.workflow === undefined) {
+        const workflow = def.workflow;
+        if (workflow === undefined) {
             throw new SchemaError('workflow.transition.unknown', { object: objectName, action }, ctx.locale);
         }
         if (primaryNames(def).length === 0) {
             throw new SchemaError('data.recordNotFound', { object: objectName, id }, ctx.locale);
         }
         const pkValues = pkValuesOf(def, id, ctx);
+        // a policy self-filters on `workflow.transition.<object>.<action>`; a node may
+        // also declare `requiresApproval` (deny → error; requireApproval → pending)
+        const approvalNodes = workflow.nodes.some((n) => n.requiresApproval === true);
+        return this.governed({ action: `workflow.transition.${def.name}.${action}`, objectName, objectId: id, args: { object: def.name, id, action } }, ctx, {
+            pendingCode: 'workflow.transition.pending',
+            actionParam: action,
+            preflight: async () => {
+                const [sql, params] = this.transitionTargetSql(def, pkValues, action, ctx);
+                const { rows } = action === WORKFLOW_ACTIONS.SUBMIT
+                    ? await this.readScoped(ctx, (db) => runTableQuery(db, objectName, sql, params, ctx.locale))
+                    : await runTableQuery(ctx.client ?? ctx.pool, objectName, sql, params, ctx.locale);
+                if (rows[0] === undefined)
+                    throw new SchemaError('data.recordNotFound', { object: objectName, id }, ctx.locale);
+            },
+            onReject: (error) => auditWrite(this.audit, ctx, DATA_ACTIONS.TRANSITION, objectName, id, { action }, error),
+            ...(approvalNodes
+                ? {
+                    requireApproval: async () => {
+                        const status = await getWorkflowStatus(ctx.client ?? ctx.pool, def, id, subjectOf(ctx));
+                        return workflow.nodes.find((n) => n.id === status.node)?.requiresApproval === true;
+                    },
+                }
+                : {}),
+        }, () => this.doTransition(def, id, pkValues, action, ctx, payload));
+    }
+    /**
+     * Existence check for a transition target. Submit is an owner action → the
+     * caller's manage scope; the other actions are authorized by workitem
+     * assignment / originator, not by row scope.
+     */
+    transitionTargetSql(def, pkValues, action, ctx) {
+        const { sql, params } = buildFindSql(def, { filter: pkFilter(def, pkValues), limit: 1 }, bctx(ctx, def.name), action === WORKFLOW_ACTIONS.SUBMIT ? ctx.rowScope : undefined, undefined, [recordKeySelect(def)]);
+        return [sql, params];
+    }
+    async doTransition(def, id, pkValues, action, ctx, payload) {
+        const objectName = def.name;
+        const workflow = def.workflow;
         let client;
         let owned = false;
         if (ctx.client !== undefined) {
@@ -751,41 +876,12 @@ export class DefaultObjectDataAccess {
             if (owned)
                 await client.query('BEGIN');
             // the customer record must exist (transitions never create records)
-            const { sql, params } = buildFindSql(def, { filter: pkFilter(def, pkValues), limit: 1 }, bctx(ctx, objectName), undefined, undefined, [recordKeySelect(def)]);
-            const found = await runTableQuery(client, objectName, sql, params, ctx.locale);
+            const [sql, params] = this.transitionTargetSql(def, pkValues, action, ctx);
+            const lookup = () => runTableQuery(client, objectName, sql, params, ctx.locale);
+            const found = action === WORKFLOW_ACTIONS.SUBMIT ? await this.underRls(client, ctx, lookup) : await lookup();
             if (found.rows[0] === undefined) {
                 throw new SchemaError('data.recordNotFound', { object: objectName, id }, ctx.locale);
             }
-            // guardrail policy + approval gate (shared policy set with the open contract):
-            // a policy self-filters on `workflow.transition.<object>.<action>`; a node may
-            // also declare `requiresApproval`. deny → error; requireApproval → pending.
-            const currentNode = await getWorkflowStatus(client, def, id, subjectOf(ctx));
-            const nodeDef = currentNode.node === undefined ? undefined : def.workflow.nodes.find((n) => n.id === currentNode.node);
-            const requireApproval = nodeDef?.requiresApproval === true;
-            if (this.policies.length > 0 || requireApproval) {
-                const subject = subjectOf(ctx);
-                const actorId = subject?.id ?? principalActorId(ctx.principal);
-                const guardrailCtx = {
-                    actor: { key: actorId, label: actorId, onBehalfOf: actorId },
-                    subject: subject ?? { id: 'system', roles: [] },
-                    action: `workflow.transition.${def.name}.${action}`,
-                    args: { object: def.name, id, action },
-                    dataAccess: toolDataAccessOver(this, {
-                        pool: ctx.pool,
-                        registry: ctx.registry,
-                        principal: ctx.principal,
-                        ...(ctx.locale === undefined ? {} : { locale: ctx.locale }),
-                        ...(ctx.client === undefined ? {} : { client: ctx.client }),
-                    }),
-                };
-                const gate = await evaluateTransition(this.policies, this.approvals, guardrailCtx, requireApproval);
-                if (gate.kind === 'deny') {
-                    throw new SchemaError(gate.code, { object: objectName, action, reason: gate.reason ?? '' }, ctx.locale);
-                }
-                if (gate.kind === 'pending') {
-                    throw new SchemaError('workflow.transition.pending', { object: objectName, action, approvalKey: gate.approvalKey }, ctx.locale);
-                }
-            }
             const outcome = await runWorkflowTransition(client, def, id, action, subjectOf(ctx), payload, ctx.locale);
             const transitionChanges = {
                 action,
@@ -803,7 +899,7 @@ export class DefaultObjectDataAccess {
                 await auditWrite(this.audit, ctx, DATA_ACTIONS.TRANSITION, objectName, id, transitionChanges);
             }
             this.events?.publishRecordChange('updated', objectName, id);
-            this.events?.publishRecordTransitioned(objectName, id, outcome.fromNodeId ?? '', outcome.toNodeId ?? '', action, def.workflow.version, def.workflowHash);
+            this.events?.publishRecordTransitioned(objectName, id, outcome.fromNodeId ?? '', outcome.toNodeId ?? '', action, workflow.version, def.workflowHash);
             if (outcome.nodeId !== undefined) {
                 await this.workflowTimers?.sync(objectName, id, outcome.nodeId).catch(() => { });
             }
@@ -841,8 +937,34 @@ export class DefaultObjectDataAccess {
         if (def.workflow === undefined) {
             throw new SchemaError('workflow.transition.unknown', { object: objectName, action: 'status' }, ctx.locale);
         }
+        await this.assertWorkflowVisible(def, id, ctx);
         return getWorkflowStatus(ctx.client ?? ctx.pool, def, id, subjectOf(ctx));
     }
+    /**
+     * A record's workflow is visible when the record is inside the caller's read
+     * scope, or the caller participates (originator / any workitem) — an assigned
+     * approver may sit outside the record's row scope.
+     */
+    async assertWorkflowVisible(def, id, ctx) {
+        if (ctx.rowScope === undefined)
+            return;
+        const db = ctx.client ?? ctx.pool;
+        const pkValues = pkValuesOf(def, id, ctx);
+        const { sql, params } = buildFindSql(def, { filter: pkFilter(def, pkValues), limit: 1 }, bctx(ctx, def.name), ctx.rowScope);
+        const { rows } = await this.readScoped(ctx, (scoped) => runTableQuery(scoped, def.name, sql, params, ctx.locale));
+        if (rows.length > 0)
+            return;
+        const subject = subjectOf(ctx);
+        if (subject !== undefined) {
+            const res = await db.query(`SELECT 1 FROM ${q(SYSTEM_TABLES.WORKFLOW_INSTANCES)} WHERE object = $1 AND record_key = $2 AND originator = $3
+         UNION ALL
+         SELECT 1 FROM ${q(SYSTEM_TABLES.WORKFLOW_WORKITEMS)} WHERE object = $1 AND record_key = $2 AND participant = $3
+         LIMIT 1`, [def.name, id, subject.id]);
+            if (res.rows.length > 0)
+                return;
+        }
+        throw new SchemaError('data.recordNotFound', { object: def.name, id }, ctx.locale);
+    }
     /** Acquire/renew the caller's presence lock on the current step (TTL lease). */
     async acquireWorkflowLock(objectName, id, ctx) {
         const def = requireDef(ctx, objectName);
@@ -859,6 +981,7 @@ export class DefaultObjectDataAccess {
         if (def.workflow === undefined) {
             throw new SchemaError('workflow.transition.unknown', { object: objectName, action: 'history' }, ctx.locale);
         }
+        await this.assertWorkflowVisible(def, id, ctx);
         return getWorkflowHistory(ctx.client ?? ctx.pool, def, id);
     }
     /** The subject's pending workitems across all objects. */
@@ -914,13 +1037,12 @@ export class DefaultObjectDataAccess {
             ? { createdBy: actor, modifiedBy: actor, createdTime: now, modifiedTime: now }
             : { modifiedBy: actor, modifiedTime: now });
     }
-    async delete(objectName, id, ctx) {
+    async doDelete(objectName, id, ctx) {
         const def = requireDef(ctx, objectName);
         if (primaryNames(def).length === 0) {
             throw new SchemaError('data.recordNotFound', { object: objectName, id }, ctx.locale);
         }
         const pkValues = pkValuesOf(def, id, ctx);
-        await this.guardWrite('delete', objectName, ctx, {});
         let client;
         let owned = false;
         if (ctx.client !== undefined) {
@@ -935,7 +1057,7 @@ export class DefaultObjectDataAccess {
             if (owned)
                 await client.query('BEGIN');
             const { sql, params } = buildFindSql(def, { filter: pkFilter(def, pkValues), limit: 1 }, bctx(ctx, objectName), ctx.rowScope, undefined, [recordKeySelect(def)]);
-            const { rows } = await runTableQuery(client, objectName, sql, params, ctx.locale);
+            const { rows } = await this.underRls(client, ctx, () => runTableQuery(client, objectName, sql, params, ctx.locale));
             const raw = rows[0];
             if (raw === undefined) {
                 throw new SchemaError('data.recordNotFound', { object: objectName, id }, ctx.locale);
@@ -946,7 +1068,7 @@ export class DefaultObjectDataAccess {
             await this.runBeforeHook(SCRIPT_HOOKS.BEFORE_DELETE, objectName, existing, {}, ctx);
             await deleteDetailsChildren(client, def, id, ctx.registry);
             const scope = ctx.rowScope !== undefined ? scopeSuffix(ctx.rowScope, pkValues.length) : undefined;
-            const res = await runTableQuery(client, objectName, `DELETE FROM ${q(def.name)} WHERE ${pkWhereSql(def, 1)}${scope !== undefined ? ` AND (${scope.sql})` : ''}`, [...pkValues, ...(scope?.params ?? [])], ctx.locale);
+            const res = await this.underRls(client, ctx, () => runTableQuery(client, objectName, `DELETE FROM ${q(def.name)} WHERE ${pkWhereSql(def, 1)}${scope !== undefined ? ` AND (${scope.sql})` : ''}`, [...pkValues, ...(scope?.params ?? [])], ctx.locale));
             if (res.rowCount === 0)
                 throw new SchemaError('data.recordNotFound', { object: objectName, id }, ctx.locale);
             await deleteRecordMeta(client, def.name, metaKey);