thinkwork-cli 0.12.17 → 0.13.1

package/dist/drizzle/0227_analyst_reader_role.sql

@@ -325,26 +325,41 @@ BEGIN
   ELSE
     missing := missing || 'billing_export_line_items'::text;
   END IF;
-  IF to_regclass('public.brain_dream_actions') IS NOT NULL THEN
-    GRANT SELECT ON public.brain_dream_actions TO analyst_reader;
+  IF to_regclass('public.budget_policies') IS NOT NULL THEN
+    GRANT SELECT ON public.budget_policies TO analyst_reader;
   ELSE
-    missing := missing || 'brain_dream_actions'::text;
+    missing := missing || 'budget_policies'::text;
   END IF;
-  IF to_regclass('public.brain_dream_runs') IS NOT NULL THEN
-    GRANT SELECT ON public.brain_dream_runs TO analyst_reader;
+  IF to_regclass('public.capability_broker_calls') IS NOT NULL THEN
+    GRANT SELECT ON public.capability_broker_calls TO analyst_reader;
   ELSE
-    missing := missing || 'brain_dream_runs'::text;
+    missing := missing || 'capability_broker_calls'::text;
   END IF;
-  IF to_regclass('public.budget_policies') IS NOT NULL THEN
-    GRANT SELECT ON public.budget_policies TO analyst_reader;
+  IF to_regclass('public.capability_broker_sessions') IS NOT NULL THEN
+    GRANT SELECT ON public.capability_broker_sessions TO analyst_reader;
   ELSE
-    missing := missing || 'budget_policies'::text;
+    missing := missing || 'capability_broker_sessions'::text;
   END IF;
   IF to_regclass('public.capability_catalog') IS NOT NULL THEN
     GRANT SELECT ON public.capability_catalog TO analyst_reader;
   ELSE
     missing := missing || 'capability_catalog'::text;
   END IF;
+  IF to_regclass('public.capability_connection_proposals') IS NOT NULL THEN
+    GRANT SELECT ON public.capability_connection_proposals TO analyst_reader;
+  ELSE
+    missing := missing || 'capability_connection_proposals'::text;
+  END IF;
+  IF to_regclass('public.capability_definitions') IS NOT NULL THEN
+    GRANT SELECT ON public.capability_definitions TO analyst_reader;
+  ELSE
+    missing := missing || 'capability_definitions'::text;
+  END IF;
+  IF to_regclass('public.capability_routine_proposals') IS NOT NULL THEN
+    GRANT SELECT ON public.capability_routine_proposals TO analyst_reader;
+  ELSE
+    missing := missing || 'capability_routine_proposals'::text;
+  END IF;
   IF to_regclass('public.connections') IS NOT NULL THEN
     GRANT SELECT ON public.connections TO analyst_reader;
   ELSE
@@ -510,36 +525,16 @@ BEGIN
   ELSE
     missing := missing || 'inbox_items'::text;
   END IF;
+  IF to_regclass('public.knowledge_base_documents') IS NOT NULL THEN
+    GRANT SELECT ON public.knowledge_base_documents TO analyst_reader;
+  ELSE
+    missing := missing || 'knowledge_base_documents'::text;
+  END IF;
   IF to_regclass('public.knowledge_bases') IS NOT NULL THEN
     GRANT SELECT ON public.knowledge_bases TO analyst_reader;
   ELSE
     missing := missing || 'knowledge_bases'::text;
   END IF;
-  IF to_regclass('public.knowledge_graph_entities') IS NOT NULL THEN
-    GRANT SELECT ON public.knowledge_graph_entities TO analyst_reader;
-  ELSE
-    missing := missing || 'knowledge_graph_entities'::text;
-  END IF;
-  IF to_regclass('public.knowledge_graph_evidence') IS NOT NULL THEN
-    GRANT SELECT ON public.knowledge_graph_evidence TO analyst_reader;
-  ELSE
-    missing := missing || 'knowledge_graph_evidence'::text;
-  END IF;
-  IF to_regclass('public.knowledge_graph_ingest_runs') IS NOT NULL THEN
-    GRANT SELECT ON public.knowledge_graph_ingest_runs TO analyst_reader;
-  ELSE
-    missing := missing || 'knowledge_graph_ingest_runs'::text;
-  END IF;
-  IF to_regclass('public.knowledge_graph_observation_cursors') IS NOT NULL THEN
-    GRANT SELECT ON public.knowledge_graph_observation_cursors TO analyst_reader;
-  ELSE
-    missing := missing || 'knowledge_graph_observation_cursors'::text;
-  END IF;
-  IF to_regclass('public.knowledge_graph_relationships') IS NOT NULL THEN
-    GRANT SELECT ON public.knowledge_graph_relationships TO analyst_reader;
-  ELSE
-    missing := missing || 'knowledge_graph_relationships'::text;
-  END IF;
   IF to_regclass('public.linked_task_events') IS NOT NULL THEN
     GRANT SELECT ON public.linked_task_events TO analyst_reader;
   ELSE
@@ -565,10 +560,57 @@ BEGIN
   ELSE
     missing := missing || 'managed_applications'::text;
   END IF;
-  IF to_regclass('public.memory_retain_attempts') IS NOT NULL THEN
-    GRANT SELECT ON public.memory_retain_attempts TO analyst_reader;
+  IF to_regclass('public.memory_claim_evidence') IS NOT NULL THEN
+    GRANT SELECT ON public.memory_claim_evidence TO analyst_reader;
+  ELSE
+    missing := missing || 'memory_claim_evidence'::text;
+  END IF;
+  IF to_regclass('public.memory_claims') IS NOT NULL THEN
+    REVOKE ALL PRIVILEGES ON public.memory_claims FROM analyst_reader;
+    GRANT SELECT (canonical_subject_id, conflict_state, created_at, effective_from, effective_to, extraction_version, id, ontology_predicate, status, subject_entity_type, subject_key, target_id, target_scope, tenant_id, updated_at, value_hash) ON public.memory_claims TO analyst_reader;
+  ELSE
+    missing := missing || 'memory_claims'::text;
+  END IF;
+  IF to_regclass('public.memory_derivations') IS NOT NULL THEN
+    GRANT SELECT ON public.memory_derivations TO analyst_reader;
+  ELSE
+    missing := missing || 'memory_derivations'::text;
+  END IF;
+  IF to_regclass('public.memory_evidence_items') IS NOT NULL THEN
+    REVOKE ALL PRIVILEGES ON public.memory_evidence_items FROM analyst_reader;
+    GRANT SELECT (acquisition_run_id, content_hash, created_at, extraction_recipe, id, last_error, lifecycle, sensitivity, snapshot_expires_at, snapshot_ref, source_config_id, source_item_id, source_timestamp, source_version, target_id, target_scope, tenant_id, updated_at) ON public.memory_evidence_items TO analyst_reader;
+  ELSE
+    missing := missing || 'memory_evidence_items'::text;
+  END IF;
+  IF to_regclass('public.memory_processor_configs') IS NOT NULL THEN
+    GRANT SELECT ON public.memory_processor_configs TO analyst_reader;
+  ELSE
+    missing := missing || 'memory_processor_configs'::text;
+  END IF;
+  IF to_regclass('public.memory_retraction_attempts') IS NOT NULL THEN
+    GRANT SELECT ON public.memory_retraction_attempts TO analyst_reader;
+  ELSE
+    missing := missing || 'memory_retraction_attempts'::text;
+  END IF;
+  IF to_regclass('public.memory_run_items') IS NOT NULL THEN
+    GRANT SELECT ON public.memory_run_items TO analyst_reader;
+  ELSE
+    missing := missing || 'memory_run_items'::text;
+  END IF;
+  IF to_regclass('public.memory_source_authorizations') IS NOT NULL THEN
+    GRANT SELECT ON public.memory_source_authorizations TO analyst_reader;
   ELSE
-    missing := missing || 'memory_retain_attempts'::text;
+    missing := missing || 'memory_source_authorizations'::text;
+  END IF;
+  IF to_regclass('public.memory_source_checkpoints') IS NOT NULL THEN
+    GRANT SELECT ON public.memory_source_checkpoints TO analyst_reader;
+  ELSE
+    missing := missing || 'memory_source_checkpoints'::text;
+  END IF;
+  IF to_regclass('public.memory_source_configs') IS NOT NULL THEN
+    GRANT SELECT ON public.memory_source_configs TO analyst_reader;
+  ELSE
+    missing := missing || 'memory_source_configs'::text;
   END IF;
   IF to_regclass('public.message_artifacts') IS NOT NULL THEN
     GRANT SELECT ON public.message_artifacts TO analyst_reader;
@@ -590,6 +632,21 @@ BEGIN
   ELSE
     missing := missing || 'model_catalog'::text;
   END IF;
+  IF to_regclass('public.msteams_tenant_installs') IS NOT NULL THEN
+    GRANT SELECT ON public.msteams_tenant_installs TO analyst_reader;
+  ELSE
+    missing := missing || 'msteams_tenant_installs'::text;
+  END IF;
+  IF to_regclass('public.msteams_threads') IS NOT NULL THEN
+    GRANT SELECT ON public.msteams_threads TO analyst_reader;
+  ELSE
+    missing := missing || 'msteams_threads'::text;
+  END IF;
+  IF to_regclass('public.msteams_user_links') IS NOT NULL THEN
+    GRANT SELECT ON public.msteams_user_links TO analyst_reader;
+  ELSE
+    missing := missing || 'msteams_user_links'::text;
+  END IF;
   IF to_regclass('public.mutation_idempotency') IS NOT NULL THEN
     GRANT SELECT ON public.mutation_idempotency TO analyst_reader;
   ELSE
@@ -697,7 +754,7 @@ BEGIN
   END IF;
   IF to_regclass('public.routines') IS NOT NULL THEN
     REVOKE ALL PRIVILEGES ON public.routines FROM analyst_reader;
-    GRANT SELECT (agent_id, catalog_slug, config, created_at, current_version, description, disabled_reason, documentation_md, engine, fixture_paths, id, last_run_at, module_path, name, next_run_at, owning_agent_id, schedule, state_machine_alias_arn, state_machine_arn, status, tenant_id, type, updated_at, validated_sha, visibility) ON public.routines TO analyst_reader;
+    GRANT SELECT (agent_id, capability_dependencies, catalog_slug, config, created_at, current_version, description, disabled_reason, documentation_md, engine, execution_principal, fixture_paths, id, last_run_at, module_path, name, next_run_at, owning_agent_id, schedule, state_machine_alias_arn, state_machine_arn, status, tenant_id, type, updated_at, validated_sha, visibility) ON public.routines TO analyst_reader;
   ELSE
     missing := missing || 'routines'::text;
   END IF;
@@ -835,6 +892,11 @@ BEGIN
   ELSE
     missing := missing || 'tenant_policy_events'::text;
   END IF;
+  IF to_regclass('public.tenant_service_principals') IS NOT NULL THEN
+    GRANT SELECT ON public.tenant_service_principals TO analyst_reader;
+  ELSE
+    missing := missing || 'tenant_service_principals'::text;
+  END IF;
   IF to_regclass('public.tenant_settings') IS NOT NULL THEN
     GRANT SELECT ON public.tenant_settings TO analyst_reader;
   ELSE

package/dist/drizzle/0230_analyst_rls.sql

@@ -62,6 +62,15 @@
 -- creates-policy: public.agent_operation_leases.analyst_tenant_isolation
 -- creates-policy: public.eval_results.analyst_tenant_isolation
 -- creates-policy: public.plugin_components.analyst_tenant_isolation
+--
+-- THINK-84 U6: the msteams tables landed after this file was first applied,
+-- so their policies are declared explicitly — the drift gate must force a
+-- re-apply on databases that ran 0230 before the msteams tables existed.
+-- (0227's grants for the same tables are not marker-checkable; re-apply
+-- 0227 alongside 0233 and this file — see the 0233 header.)
+-- creates-policy: public.msteams_tenant_installs.analyst_tenant_isolation
+-- creates-policy: public.msteams_user_links.analyst_tenant_isolation
+-- creates-policy: public.msteams_threads.analyst_tenant_isolation
 
 \set ON_ERROR_STOP on
 
@@ -335,32 +344,59 @@ BEGIN
   ELSE
     missing := missing || 'billing_export_line_items'::text;
   END IF;
-  IF to_regclass('public.brain_dream_actions') IS NOT NULL THEN
-    ALTER TABLE public.brain_dream_actions ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.brain_dream_actions;
-    CREATE POLICY analyst_tenant_isolation ON public.brain_dream_actions
+  IF to_regclass('public.budget_policies') IS NOT NULL THEN
+    ALTER TABLE public.budget_policies ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.budget_policies;
+    CREATE POLICY analyst_tenant_isolation ON public.budget_policies
       FOR SELECT TO analyst_reader
-      USING (EXISTS (SELECT 1 FROM public.brain_dream_runs p WHERE p.id = public.brain_dream_actions.run_id AND p.tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid));
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
   ELSE
-    missing := missing || 'brain_dream_actions'::text;
+    missing := missing || 'budget_policies'::text;
   END IF;
-  IF to_regclass('public.brain_dream_runs') IS NOT NULL THEN
-    ALTER TABLE public.brain_dream_runs ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.brain_dream_runs;
-    CREATE POLICY analyst_tenant_isolation ON public.brain_dream_runs
+  IF to_regclass('public.capability_broker_calls') IS NOT NULL THEN
+    ALTER TABLE public.capability_broker_calls ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.capability_broker_calls;
+    CREATE POLICY analyst_tenant_isolation ON public.capability_broker_calls
       FOR SELECT TO analyst_reader
       USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
   ELSE
-    missing := missing || 'brain_dream_runs'::text;
+    missing := missing || 'capability_broker_calls'::text;
   END IF;
-  IF to_regclass('public.budget_policies') IS NOT NULL THEN
-    ALTER TABLE public.budget_policies ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.budget_policies;
-    CREATE POLICY analyst_tenant_isolation ON public.budget_policies
+  IF to_regclass('public.capability_broker_sessions') IS NOT NULL THEN
+    ALTER TABLE public.capability_broker_sessions ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.capability_broker_sessions;
+    CREATE POLICY analyst_tenant_isolation ON public.capability_broker_sessions
       FOR SELECT TO analyst_reader
       USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
   ELSE
-    missing := missing || 'budget_policies'::text;
+    missing := missing || 'capability_broker_sessions'::text;
+  END IF;
+  IF to_regclass('public.capability_connection_proposals') IS NOT NULL THEN
+    ALTER TABLE public.capability_connection_proposals ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.capability_connection_proposals;
+    CREATE POLICY analyst_tenant_isolation ON public.capability_connection_proposals
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'capability_connection_proposals'::text;
+  END IF;
+  IF to_regclass('public.capability_definitions') IS NOT NULL THEN
+    ALTER TABLE public.capability_definitions ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.capability_definitions;
+    CREATE POLICY analyst_tenant_isolation ON public.capability_definitions
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'capability_definitions'::text;
+  END IF;
+  IF to_regclass('public.capability_routine_proposals') IS NOT NULL THEN
+    ALTER TABLE public.capability_routine_proposals ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.capability_routine_proposals;
+    CREATE POLICY analyst_tenant_isolation ON public.capability_routine_proposals
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'capability_routine_proposals'::text;
   END IF;
   IF to_regclass('public.connections') IS NOT NULL THEN
     ALTER TABLE public.connections ENABLE ROW LEVEL SECURITY;
@@ -659,6 +695,15 @@ BEGIN
   ELSE
     missing := missing || 'inbox_items'::text;
   END IF;
+  IF to_regclass('public.knowledge_base_documents') IS NOT NULL THEN
+    ALTER TABLE public.knowledge_base_documents ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.knowledge_base_documents;
+    CREATE POLICY analyst_tenant_isolation ON public.knowledge_base_documents
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'knowledge_base_documents'::text;
+  END IF;
   IF to_regclass('public.knowledge_bases') IS NOT NULL THEN
     ALTER TABLE public.knowledge_bases ENABLE ROW LEVEL SECURITY;
     DROP POLICY IF EXISTS analyst_tenant_isolation ON public.knowledge_bases;
@@ -668,51 +713,6 @@ BEGIN
   ELSE
     missing := missing || 'knowledge_bases'::text;
   END IF;
-  IF to_regclass('public.knowledge_graph_entities') IS NOT NULL THEN
-    ALTER TABLE public.knowledge_graph_entities ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.knowledge_graph_entities;
-    CREATE POLICY analyst_tenant_isolation ON public.knowledge_graph_entities
-      FOR SELECT TO analyst_reader
-      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
-  ELSE
-    missing := missing || 'knowledge_graph_entities'::text;
-  END IF;
-  IF to_regclass('public.knowledge_graph_evidence') IS NOT NULL THEN
-    ALTER TABLE public.knowledge_graph_evidence ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.knowledge_graph_evidence;
-    CREATE POLICY analyst_tenant_isolation ON public.knowledge_graph_evidence
-      FOR SELECT TO analyst_reader
-      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
-  ELSE
-    missing := missing || 'knowledge_graph_evidence'::text;
-  END IF;
-  IF to_regclass('public.knowledge_graph_ingest_runs') IS NOT NULL THEN
-    ALTER TABLE public.knowledge_graph_ingest_runs ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.knowledge_graph_ingest_runs;
-    CREATE POLICY analyst_tenant_isolation ON public.knowledge_graph_ingest_runs
-      FOR SELECT TO analyst_reader
-      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
-  ELSE
-    missing := missing || 'knowledge_graph_ingest_runs'::text;
-  END IF;
-  IF to_regclass('public.knowledge_graph_observation_cursors') IS NOT NULL THEN
-    ALTER TABLE public.knowledge_graph_observation_cursors ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.knowledge_graph_observation_cursors;
-    CREATE POLICY analyst_tenant_isolation ON public.knowledge_graph_observation_cursors
-      FOR SELECT TO analyst_reader
-      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
-  ELSE
-    missing := missing || 'knowledge_graph_observation_cursors'::text;
-  END IF;
-  IF to_regclass('public.knowledge_graph_relationships') IS NOT NULL THEN
-    ALTER TABLE public.knowledge_graph_relationships ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.knowledge_graph_relationships;
-    CREATE POLICY analyst_tenant_isolation ON public.knowledge_graph_relationships
-      FOR SELECT TO analyst_reader
-      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
-  ELSE
-    missing := missing || 'knowledge_graph_relationships'::text;
-  END IF;
   IF to_regclass('public.linked_task_events') IS NOT NULL THEN
     ALTER TABLE public.linked_task_events ENABLE ROW LEVEL SECURITY;
     DROP POLICY IF EXISTS analyst_tenant_isolation ON public.linked_task_events;
@@ -758,14 +758,95 @@ BEGIN
   ELSE
     missing := missing || 'managed_applications'::text;
   END IF;
-  IF to_regclass('public.memory_retain_attempts') IS NOT NULL THEN
-    ALTER TABLE public.memory_retain_attempts ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.memory_retain_attempts;
-    CREATE POLICY analyst_tenant_isolation ON public.memory_retain_attempts
+  IF to_regclass('public.memory_claim_evidence') IS NOT NULL THEN
+    ALTER TABLE public.memory_claim_evidence ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.memory_claim_evidence;
+    CREATE POLICY analyst_tenant_isolation ON public.memory_claim_evidence
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'memory_claim_evidence'::text;
+  END IF;
+  IF to_regclass('public.memory_claims') IS NOT NULL THEN
+    ALTER TABLE public.memory_claims ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.memory_claims;
+    CREATE POLICY analyst_tenant_isolation ON public.memory_claims
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'memory_claims'::text;
+  END IF;
+  IF to_regclass('public.memory_derivations') IS NOT NULL THEN
+    ALTER TABLE public.memory_derivations ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.memory_derivations;
+    CREATE POLICY analyst_tenant_isolation ON public.memory_derivations
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'memory_derivations'::text;
+  END IF;
+  IF to_regclass('public.memory_evidence_items') IS NOT NULL THEN
+    ALTER TABLE public.memory_evidence_items ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.memory_evidence_items;
+    CREATE POLICY analyst_tenant_isolation ON public.memory_evidence_items
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'memory_evidence_items'::text;
+  END IF;
+  IF to_regclass('public.memory_processor_configs') IS NOT NULL THEN
+    ALTER TABLE public.memory_processor_configs ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.memory_processor_configs;
+    CREATE POLICY analyst_tenant_isolation ON public.memory_processor_configs
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'memory_processor_configs'::text;
+  END IF;
+  IF to_regclass('public.memory_retraction_attempts') IS NOT NULL THEN
+    ALTER TABLE public.memory_retraction_attempts ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.memory_retraction_attempts;
+    CREATE POLICY analyst_tenant_isolation ON public.memory_retraction_attempts
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'memory_retraction_attempts'::text;
+  END IF;
+  IF to_regclass('public.memory_run_items') IS NOT NULL THEN
+    ALTER TABLE public.memory_run_items ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.memory_run_items;
+    CREATE POLICY analyst_tenant_isolation ON public.memory_run_items
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'memory_run_items'::text;
+  END IF;
+  IF to_regclass('public.memory_source_authorizations') IS NOT NULL THEN
+    ALTER TABLE public.memory_source_authorizations ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.memory_source_authorizations;
+    CREATE POLICY analyst_tenant_isolation ON public.memory_source_authorizations
       FOR SELECT TO analyst_reader
       USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
   ELSE
-    missing := missing || 'memory_retain_attempts'::text;
+    missing := missing || 'memory_source_authorizations'::text;
+  END IF;
+  IF to_regclass('public.memory_source_checkpoints') IS NOT NULL THEN
+    ALTER TABLE public.memory_source_checkpoints ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.memory_source_checkpoints;
+    CREATE POLICY analyst_tenant_isolation ON public.memory_source_checkpoints
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'memory_source_checkpoints'::text;
+  END IF;
+  IF to_regclass('public.memory_source_configs') IS NOT NULL THEN
+    ALTER TABLE public.memory_source_configs ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.memory_source_configs;
+    CREATE POLICY analyst_tenant_isolation ON public.memory_source_configs
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'memory_source_configs'::text;
   END IF;
   IF to_regclass('public.message_artifacts') IS NOT NULL THEN
     ALTER TABLE public.message_artifacts ENABLE ROW LEVEL SECURITY;
@@ -794,6 +875,33 @@ BEGIN
   ELSE
     missing := missing || 'messages'::text;
   END IF;
+  IF to_regclass('public.msteams_tenant_installs') IS NOT NULL THEN
+    ALTER TABLE public.msteams_tenant_installs ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.msteams_tenant_installs;
+    CREATE POLICY analyst_tenant_isolation ON public.msteams_tenant_installs
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'msteams_tenant_installs'::text;
+  END IF;
+  IF to_regclass('public.msteams_threads') IS NOT NULL THEN
+    ALTER TABLE public.msteams_threads ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.msteams_threads;
+    CREATE POLICY analyst_tenant_isolation ON public.msteams_threads
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'msteams_threads'::text;
+  END IF;
+  IF to_regclass('public.msteams_user_links') IS NOT NULL THEN
+    ALTER TABLE public.msteams_user_links ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.msteams_user_links;
+    CREATE POLICY analyst_tenant_isolation ON public.msteams_user_links
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'msteams_user_links'::text;
+  END IF;
   IF to_regclass('public.mutation_idempotency') IS NOT NULL THEN
     ALTER TABLE public.mutation_idempotency ENABLE ROW LEVEL SECURITY;
     DROP POLICY IF EXISTS analyst_tenant_isolation ON public.mutation_idempotency;
@@ -1226,6 +1334,15 @@ BEGIN
   ELSE
     missing := missing || 'tenant_policy_events'::text;
   END IF;
+  IF to_regclass('public.tenant_service_principals') IS NOT NULL THEN
+    ALTER TABLE public.tenant_service_principals ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.tenant_service_principals;
+    CREATE POLICY analyst_tenant_isolation ON public.tenant_service_principals
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'tenant_service_principals'::text;
+  END IF;
   IF to_regclass('public.tenant_settings') IS NOT NULL THEN
     ALTER TABLE public.tenant_settings ENABLE ROW LEVEL SECURITY;
     DROP POLICY IF EXISTS analyst_tenant_isolation ON public.tenant_settings;