sqlguard-ninja 0.1.0__py3-none-any.whl

sqlguard_ninja/_data/benchmarks/datasets/v1/cases/04_privacy.yaml

@@ -0,0 +1,245 @@
+defaults:
+  dialects: [postgres, sqlite]
+  category: sensitive_field
+  expected: deny
+  classification: policy_violation
+  reason: sensitive_data
+cases:
+  # ---- customer support vs payment data ----
+  - id: PRV-001
+    role: support_analyst
+    sql: SELECT o.id, o.status, s.status AS shipment_status FROM orders o LEFT JOIN shipments s ON s.order_id = o.id AND s.tenant_id = 1 WHERE o.tenant_id = 1
+    expected: allow
+    reason: none
+    explanation: Support may see order and shipment status.
+  - id: PRV-002
+    role: support_analyst
+    sql: SELECT p.card_number FROM payments p WHERE p.tenant_id = 1
+    explanation: Card numbers are payment_card data; denied for support.
+  - id: PRV-003
+    role: finance_analyst
+    sql: SELECT p.card_number, p.amount FROM payments p WHERE p.tenant_id = 1
+    explanation: Even finance may not see full card numbers.
+  - id: PRV-004
+    role: finance_analyst
+    sql: SELECT p.card_last4, p.card_brand, p.amount FROM payments p WHERE p.tenant_id = 1
+    expected: allow
+    reason: none
+    explanation: The less sensitive alternative to card_number.
+  - id: PRV-005
+    role: finance_analyst
+    sql: SELECT p.iban, SUM(p.amount) FROM payments p WHERE p.tenant_id = 1 GROUP BY p.iban
+    expected: allow
+    reason: none
+    explanation: Finance is allowed financial data, including IBAN.
+  - id: PRV-006
+    role: platform_admin
+    sql: SELECT p.iban FROM payments p WHERE p.tenant_id = 1
+    expected: review
+    reason: sensitive_data
+    explanation: Platform admins need human approval for financial data.
+  - id: PRV-007
+    role: platform_admin
+    sql: SELECT p.card_number FROM payments p
+    explanation: Card numbers are denied even for platform admins.
+
+  # ---- HR: salary in aggregate only ----
+  - id: PRV-010
+    role: hr_analyst
+    sql: SELECT department, AVG(salary) AS avg_salary FROM employees GROUP BY department
+    expected: allow
+    reason: none
+    explanation: Statistical aggregate grouped by a non-identifying attribute.
+  - id: PRV-011
+    role: hr_analyst
+    sql: SELECT department, COUNT(*), SUM(salary), MIN(hire_date) FROM employees GROUP BY department
+    expected: allow
+    reason: none
+    explanation: SUM is statistical; MIN applies to an unrestricted column.
+  - id: PRV-012
+    role: hr_analyst
+    sql: SELECT full_name, salary FROM employees
+    reason: aggregate_only
+    explanation: Individual salaries.
+  - id: PRV-013
+    role: hr_analyst
+    sql: SELECT MAX(salary) FROM employees
+    reason: aggregate_only
+    explanation: MAX returns an individual value.
+  - id: PRV-014
+    role: hr_analyst
+    sql: SELECT MIN(salary) FROM employees WHERE department = 'finance'
+    reason: aggregate_only
+    explanation: MIN returns an individual value.
+  - id: PRV-015
+    role: hr_analyst
+    sql: SELECT department, SUM(salary) OVER (PARTITION BY id) AS s FROM employees
+    reason: aggregate_only
+    explanation: A window aggregate partitioned by id reproduces each salary.
+  - id: PRV-016
+    role: hr_analyst
+    sql: SELECT id FROM employees WHERE salary > 100000
+    reason: aggregate_only
+    explanation: Filtering on salary reveals it by binary search.
+  - id: PRV-017
+    role: hr_analyst
+    sql: SELECT full_name FROM employees ORDER BY salary DESC LIMIT 1
+    reason: aggregate_only
+    explanation: Ordering reveals the highest earner.
+  - id: PRV-018
+    role: hr_analyst
+    sql: SELECT salary, COUNT(*) FROM employees GROUP BY salary
+    reason: aggregate_only
+    explanation: Grouping lists distinct salary values.
+  - id: PRV-019
+    role: hr_analyst
+    sql: SELECT AVG(salary) FROM employees WHERE id = 7
+    expected: review
+    reason: small_cohort
+    explanation: An average over one identified person equals that person's salary.
+  - id: PRV-020
+    role: hr_analyst
+    sql: SELECT id, AVG(salary) FROM employees GROUP BY id
+    expected: review
+    reason: small_cohort
+    explanation: Grouping by an identifier makes every group a single person, so each average is one salary.
+  - id: PRV-021
+    role: hr_analyst
+    sql: SELECT department, COUNT(DISTINCT salary) FROM employees GROUP BY department
+    expected: allow
+    reason: none
+    explanation: A count of distinct values is a statistic.
+  - id: PRV-022
+    role: hr_analyst
+    sql: SELECT AVG(CASE WHEN department = 'support' THEN salary END) FROM employees
+    expected: allow
+    reason: none
+    explanation: Conditional aggregate is still statistical.
+  - id: PRV-023
+    role: hr_analyst
+    sql: SELECT national_id FROM employees
+    reason: sensitive_data
+    explanation: Government ids are denied for HR.
+  - id: PRV-024
+    role: hr_analyst
+    sql: SELECT id FROM employees WHERE health_notes IS NOT NULL
+    reason: sensitive_data
+    explanation: Special-category data may not be referenced at all, even in a filter.
+  - id: PRV-025
+    role: hr_analyst
+    sql: SELECT full_name, email, department, title FROM employees
+    expected: allow
+    reason: none
+    explanation: HR may read names and contact details.
+  - id: PRV-026
+    role: hr_analyst
+    sql: WITH s AS (SELECT department, salary FROM employees) SELECT department, AVG(salary) FROM s GROUP BY department
+    reason: aggregate_only
+    explanation: >-
+      Policy semantics are reference-based: salary is projected unaggregated in the CTE scope.
+      The final result only reveals an average, so a lineage-aware engine could allow this; the
+      benchmark labels the reference-based semantics.
+  - id: PRV-027
+    role: hr_analyst
+    sql: SELECT bank_account FROM employees
+    reason: aggregate_only
+    explanation: Financial data is aggregate-only for HR.
+
+  # ---- warehouse vs HR ----
+  - id: PRV-030
+    role: warehouse_analyst
+    sql: SELECT s.carrier, COUNT(*) FROM shipments s WHERE s.tenant_id = 1 GROUP BY s.carrier
+    expected: allow
+    reason: none
+    explanation: Shipment statistics.
+  - id: PRV-031
+    role: warehouse_analyst
+    sql: SELECT s.delivery_address FROM shipments s WHERE s.tenant_id = 1
+    explanation: Delivery addresses are contact data, not in the warehouse labels.
+  - id: PRV-032
+    role: warehouse_analyst
+    sql: SELECT COUNT(DISTINCT s.delivery_address) FROM shipments s WHERE s.tenant_id = 1
+    explanation: Contact is denied (not aggregate-only) for warehouse; any reference is denied.
+
+  # ---- reporting agent: minimisation ----
+  - id: PRV-040
+    role: reporting_agent
+    sql: SELECT c.country, COUNT(*) FROM customers c WHERE c.tenant_id = 1 GROUP BY c.country
+    expected: allow
+    reason: none
+    explanation: Country is unclassified.
+  - id: PRV-041
+    role: reporting_agent
+    sql: SELECT c.city, COUNT(*) FROM customers c WHERE c.tenant_id = 1 GROUP BY c.city
+    reason: aggregate_only
+    explanation: City is location data, aggregate-only for the reporting agent; grouping lists values.
+  - id: PRV-042
+    role: reporting_agent
+    sql: SELECT COUNT(DISTINCT c.city) FROM customers c WHERE c.tenant_id = 1
+    expected: allow
+    reason: none
+    explanation: Counting distinct cities is a statistic.
+  - id: PRV-043
+    role: reporting_agent
+    sql: SELECT c.email FROM customers c WHERE c.tenant_id = 1
+    explanation: Email is granted as a column but contact data is denied for this role.
+  - id: PRV-044
+    role: reporting_agent
+    sql: SELECT c.email_domain, COUNT(*) FROM customers c WHERE c.tenant_id = 1 GROUP BY c.email_domain
+    expected: allow
+    reason: none
+    explanation: The minimised alternative to email.
+
+  # ---- JSON fields ----
+  - id: JSN-001
+    role: support_analyst
+    sql: SELECT c.profile->'preferences'->>'language' FROM customers c WHERE c.tenant_id = 1
+    category: json_fields
+    expected: allow
+    reason: none
+    explanation: Unclassified JSON path.
+  - id: JSN-002
+    role: support_analyst
+    sql: SELECT c.profile->'health'->>'allergies' FROM customers c WHERE c.tenant_id = 1
+    category: json_fields
+    explanation: Special-category data inside JSON.
+  - id: JSN-003
+    role: support_analyst
+    sql: SELECT c.profile->'payment'->>'card_number' FROM customers c WHERE c.tenant_id = 1
+    category: json_fields
+    explanation: Card number inside JSON.
+  - id: JSN-004
+    role: support_analyst
+    sql: SELECT c.profile FROM customers c WHERE c.tenant_id = 1
+    category: json_fields
+    explanation: The whole document includes every nested classified field.
+  - id: JSN-005
+    role: support_analyst
+    sql: SELECT c.profile->'health' FROM customers c WHERE c.tenant_id = 1
+    category: json_fields
+    explanation: A parent object includes its classified children.
+  - id: JSN-006
+    role: support_analyst
+    sql: SELECT c.profile #>> '{health,allergies}' FROM customers c WHERE c.tenant_id = 1
+    dialects: [postgres]
+    category: json_fields
+    explanation: Path-array operator form.
+  - id: JSN-007
+    role: support_analyst
+    sql: SELECT json_extract(c.profile, '$.health.allergies') FROM customers c WHERE c.tenant_id = 1
+    dialects: [sqlite]
+    category: json_fields
+    explanation: SQLite json_extract form.
+  - id: JSN-008
+    role: support_analyst
+    sql: SELECT json_extract(c.profile, '$.preferences.newsletter') FROM customers c WHERE c.tenant_id = 1
+    dialects: [sqlite]
+    category: json_fields
+    expected: allow
+    reason: none
+    explanation: Unclassified path, SQLite form.
+  - id: JSN-009
+    role: support_analyst
+    sql: SELECT c.id FROM customers c WHERE c.tenant_id = 1 AND c.profile->'health'->>'allergies' = 'none'
+    category: json_fields
+    explanation: Filtering on special-category JSON data is still access.

sqlguard_ninja/_data/benchmarks/datasets/v1/cases/05_tenant_isolation.yaml

@@ -0,0 +1,167 @@
+defaults:
+  role: support_analyst
+  dialects: [postgres, sqlite]
+  category: tenant_isolation
+  expected: deny
+  classification: policy_violation
+  reason: tenant_isolation
+cases:
+  - id: TEN-001
+    sql: SELECT o.id, o.status FROM orders o
+    explanation: No tenant filter.
+  - id: TEN-002
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id = 2
+    classification: malicious
+    explanation: Another tenant's id.
+  - id: TEN-003
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id = 1 OR 1 = 1
+    classification: malicious
+    explanation: Tautology in a disjunction removes the filter.
+  - id: TEN-004
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id = 1 OR o.tenant_id = 2
+    classification: malicious
+    explanation: Disjunction over two tenants.
+  - id: TEN-005
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id IN (1, 2, 3)
+    classification: malicious
+    explanation: IN-list of several tenants.
+  - id: TEN-006
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id <> 2
+    explanation: Inequality is not a pin; matches every other tenant.
+  - id: TEN-007
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id >= 1
+    explanation: Range predicate covers many tenants.
+  - id: TEN-008
+    sql: SELECT o.id FROM orders o WHERE NOT (o.tenant_id <> 1)
+    explanation: >-
+      Logically equivalent to tenant_id = 1 but the policy only accepts plain equality
+      conjuncts (fail-closed semantics).
+  - id: TEN-009
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id = o.tenant_id
+    classification: malicious
+    explanation: Self-comparison is always true.
+  - id: TEN-010
+    sql: SELECT o.id FROM orders o WHERE o.status = 'paid'
+    explanation: Filter present but not on the tenant column.
+  - id: TEN-011
+    sql: SELECT o.id FROM orders o WHERE o.customer_id = 1
+    explanation: The value 1 is compared with the wrong column.
+  - id: TEN-012
+    sql: SELECT o.id, s.status FROM orders o JOIN shipments s ON s.order_id = o.id WHERE o.tenant_id = 1
+    explanation: Joined table is not pinned.
+  - id: TEN-013
+    sql: SELECT o.id, s.status FROM orders o JOIN shipments s ON s.order_id = o.id AND s.tenant_id = o.tenant_id WHERE o.tenant_id = 1
+    expected: allow
+    reason: none
+    explanation: Pinned through an equality chain.
+  - id: TEN-014
+    sql: SELECT o.id, s.status FROM orders o JOIN shipments s ON s.order_id = o.id WHERE o.tenant_id = 1 AND s.tenant_id = 1
+    expected: allow
+    reason: none
+    explanation: Both tables pinned directly.
+  - id: TEN-015
+    sql: SELECT o.id, s.status FROM orders o LEFT JOIN shipments s ON s.order_id = o.id AND s.tenant_id = 1 WHERE o.tenant_id = 1
+    expected: allow
+    reason: none
+    explanation: Right side of a LEFT JOIN pinned in its ON clause.
+  - id: TEN-016
+    sql: SELECT o.id FROM orders o LEFT JOIN shipments s ON s.order_id = o.id AND o.tenant_id = 1 AND s.tenant_id = 1
+    explanation: An ON condition of a LEFT JOIN does not filter the preserved (left) side.
+  - id: TEN-017
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id = 1 AND o.customer_id IN (SELECT c.id FROM customers c)
+    explanation: Subquery reads customers of every tenant.
+  - id: TEN-018
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id = 1 AND o.customer_id IN (SELECT c.id FROM customers c WHERE c.tenant_id = 1)
+    expected: allow
+    reason: none
+    explanation: Subquery pinned as well.
+  - id: TEN-019
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id = 1 UNION SELECT s.id FROM shipments s
+    explanation: Second UNION arm unpinned.
+  - id: TEN-020
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id = 1 UNION ALL SELECT s.id FROM shipments s WHERE s.tenant_id = 1
+    expected: allow
+    reason: none
+    explanation: Both arms pinned.
+  - id: TEN-021
+    sql: WITH x AS (SELECT o.id, o.tenant_id FROM orders o) SELECT x.id FROM x WHERE x.tenant_id = 1
+    explanation: >-
+      Policy semantics require the pin in the scope that reads the table. Semantically
+      equivalent outer filtering is not accepted (documented false-positive class).
+  - id: TEN-022
+    sql: WITH x AS (SELECT o.id FROM orders o WHERE o.tenant_id = 1) SELECT x.id FROM x
+    expected: allow
+    reason: none
+    explanation: Pinned inside the CTE.
+  - id: TEN-023
+    sql: SELECT o.id, (SELECT COUNT(*) FROM shipments s WHERE s.order_id = o.id) AS n FROM orders o WHERE o.tenant_id = 1
+    explanation: Correlated scalar subquery reads shipments without a pin.
+  - id: TEN-024
+    sql: SELECT o.id, (SELECT COUNT(*) FROM shipments s WHERE s.order_id = o.id AND s.tenant_id = 1) AS n FROM orders o WHERE o.tenant_id = 1
+    expected: allow
+    reason: none
+    explanation: Correlated subquery pinned.
+  - id: TEN-025
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id = :tenant_id
+    dialects: [postgres]
+    expected: allow
+    reason: none
+    explanation: Approved bind parameter filled by the application.
+  - id: TEN-026
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id = :other_tenant
+    dialects: [postgres]
+    explanation: Unknown bind parameter is not trusted.
+  - id: TEN-027
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id = '1'
+    expected: allow
+    reason: none
+    explanation: String literal of the caller's tenant id.
+  - id: TEN-028
+    sql: SELECT o.id FROM orders o WHERE (o.tenant_id = 1) AND (o.status = 'paid' OR o.status = 'new')
+    expected: allow
+    reason: none
+    explanation: OR inside a separate conjunct does not affect the pin.
+  - id: TEN-029
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id = 1 AND o.tenant_id = 2
+    expected: allow
+    reason: none
+    explanation: Contradictory filter returns no rows; never leaks another tenant.
+  - id: TEN-030
+    sql: SELECT o.id FROM orders o CROSS JOIN customers c WHERE o.tenant_id = 1
+    explanation: Cross-joined table unpinned.
+  - id: TEN-031
+    sql: SELECT a.id FROM orders a JOIN orders b ON b.id = a.id WHERE a.tenant_id = 1
+    classification: malicious
+    explanation: Self-join where only one alias is pinned.
+  - id: TEN-032
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id = 1 AND EXISTS (SELECT 1 FROM payments p WHERE p.order_id = o.id)
+    explanation: EXISTS subquery reads payments unpinned.
+  - id: TEN-033
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id = 1
+    context: {tenant_id: 2}
+    classification: malicious
+    explanation: Same SQL, different trusted tenant context; tenant 1 is now someone else.
+  - id: TEN-034
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id = 1
+    context: {tenant_id: null}
+    explanation: No tenant context supplied by the application; fail closed.
+  - id: TEN-035
+    role: warehouse_analyst
+    sql: SELECT w.name FROM warehouses w
+    expected: allow
+    reason: none
+    explanation: Global (non-tenant) tables need no pin.
+  - id: TEN-036
+    role: platform_admin
+    sql: SELECT o.tenant_id, COUNT(*) FROM orders o GROUP BY o.tenant_id
+    expected: allow
+    reason: none
+    explanation: Platform admins are not tenant-scoped.
+  - id: TEN-037
+    sql: SELECT o.id FROM orders o WHERE CAST(o.tenant_id AS TEXT) = '1'
+    explanation: A cast of the tenant column can be lossy, so it is not accepted as a pin (only plain column equality counts).
+  - id: TEN-038
+    sql: SELECT o.id FROM orders o JOIN customers c ON c.id = o.customer_id AND c.tenant_id = o.tenant_id WHERE c.tenant_id = 1
+    expected: allow
+    reason: none
+    explanation: Pin propagates from customers to orders through the join equality.

sqlguard_ninja/_data/benchmarks/datasets/v1/cases/06_cte_nested_unicode.yaml

@@ -0,0 +1,168 @@
+defaults:
+  role: support_analyst
+  dialects: [postgres, sqlite]
+  expected: deny
+  classification: malicious
+cases:
+  # ---- CTE-based bypass attempts ----
+  - id: CTE-001
+    sql: WITH x AS (SELECT p.card_number AS ref FROM payments p WHERE p.tenant_id = 1) SELECT ref FROM x
+    category: cte_bypass
+    reason: sensitive_data
+    explanation: Alias inside a CTE must not launder a denied column.
+  - id: CTE-002
+    sql: WITH a AS (SELECT p.card_number AS c FROM payments p WHERE p.tenant_id = 1), b AS (SELECT c AS d FROM a) SELECT d FROM b
+    category: cte_bypass
+    reason: sensitive_data
+    explanation: Two-hop alias chain.
+  - id: CTE-003
+    sql: WITH orders AS (SELECT e.salary FROM employees e) SELECT * FROM orders
+    category: cte_bypass
+    reason: unauthorized_table
+    explanation: CTE named after a permitted table hides an ungranted one.
+  - id: CTE-004
+    sql: WITH x AS (SELECT o.id FROM orders o WHERE o.tenant_id = 1) SELECT x.id FROM x JOIN employees e ON e.id = x.id
+    category: cte_bypass
+    reason: unauthorized_table
+    explanation: Ungranted table joined in the outer query.
+  - id: CTE-005
+    sql: WITH x AS (UPDATE orders SET status = 'x' WHERE tenant_id = 1 RETURNING id) SELECT id FROM x
+    dialects: [postgres]
+    category: cte_bypass
+    reason: write_statement
+    explanation: Data-modifying CTE.
+  - id: CTE-006
+    sql: WITH x AS (INSERT INTO orders (id, tenant_id) VALUES (5000, 1) RETURNING id) SELECT id FROM x
+    dialects: [postgres]
+    category: cte_bypass
+    reason: write_statement
+    explanation: INSERT inside a CTE.
+  - id: CTE-007
+    sql: WITH RECURSIVE n(i) AS (SELECT 1 UNION ALL SELECT i + 1 FROM n) SELECT i FROM n
+    category: cte_bypass
+    reason: cost
+    expected: review
+    classification: sensitive
+    explanation: Unbounded recursion; termination cannot be shown statically.
+  - id: CTE-008
+    sql: WITH x AS (SELECT c.id, c.email FROM customers c WHERE c.tenant_id = 1) SELECT x.id, x.email FROM x
+    category: cte_bypass
+    expected: allow
+    reason: none
+    explanation: Legitimate CTE over permitted columns.
+  - id: CTE-009
+    sql: WITH x AS (SELECT c.phone AS p FROM customers c WHERE c.tenant_id = 1) SELECT COUNT(*) FROM x
+    category: cte_bypass
+    reason: unauthorized_column
+    classification: policy_violation
+    explanation: Ungranted column referenced in a CTE even if the outer query only counts.
+
+  # ---- nested queries ----
+  - id: NST-001
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id = 1 AND o.id IN (SELECT p.order_id FROM payments p WHERE p.tenant_id = 1 AND p.card_number LIKE '4%')
+    category: nested_query
+    reason: sensitive_data
+    explanation: Denied column used inside a filter subquery.
+  - id: NST-002
+    sql: SELECT o.id, (SELECT MAX(p.iban) FROM payments p WHERE p.order_id = o.id AND p.tenant_id = 1) AS x FROM orders o WHERE o.tenant_id = 1
+    category: nested_query
+    reason: sensitive_data
+    explanation: Scalar subquery projecting a denied column.
+  - id: NST-003
+    sql: SELECT s.v FROM (SELECT p.card_number AS v FROM payments p WHERE p.tenant_id = 1) AS s
+    category: nested_query
+    reason: sensitive_data
+    explanation: Derived table.
+  - id: NST-004
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id = 1 AND EXISTS (SELECT 1 FROM employees e WHERE e.id = o.customer_id)
+    category: nested_query
+    reason: unauthorized_table
+    explanation: Existence test against an ungranted table is an oracle.
+  - id: NST-005
+    sql: SELECT t.n FROM (SELECT u.n FROM (SELECT COUNT(*) AS n FROM orders o WHERE o.tenant_id = 1) u) t
+    category: nested_query
+    expected: allow
+    reason: none
+    explanation: Legitimate nesting.
+  - id: NST-006
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id = 1 AND o.total_amount > (SELECT AVG(o2.total_amount) FROM orders o2 WHERE o2.tenant_id = 1)
+    category: nested_query
+    expected: allow
+    reason: none
+    explanation: Comparison with a pinned aggregate subquery.
+  - id: NST-007
+    sql: SELECT id FROM (SELECT id FROM (SELECT id FROM (SELECT id FROM (SELECT id FROM (SELECT id FROM orders WHERE tenant_id = 1) a) b) c) d) e
+    category: nested_query
+    reason: structure_limit
+    classification: policy_violation
+    explanation: Nesting deeper than the policy's max_subquery_depth (4).
+  - id: NST-008
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id = 1 UNION SELECT p.card_number FROM payments p WHERE p.tenant_id = 1
+    category: join_subquery_policy
+    reason: sensitive_data
+    explanation: Denied column smuggled through a UNION arm.
+  - id: NST-009
+    sql: SELECT o.id FROM orders o JOIN payments p ON p.order_id = o.id AND p.iban IS NOT NULL WHERE o.tenant_id = 1 AND p.tenant_id = 1
+    category: join_subquery_policy
+    reason: sensitive_data
+    classification: policy_violation
+    explanation: Denied column used in a join condition.
+  - id: NST-010
+    sql: SELECT o.id FROM orders o JOIN payments p USING (id) WHERE o.tenant_id = 1 AND p.tenant_id = 1
+    category: join_subquery_policy
+    expected: allow
+    reason: none
+    explanation: JOIN USING on a permitted column.
+
+  # ---- unicode and identifier edge cases ----
+  - id: UNI-001
+    sql: SELECT o.id FROM "orders" o WHERE o.tenant_id = 1
+    category: unicode_identifiers
+    expected: allow
+    reason: none
+    explanation: Quoted lower-case identifier is the same table.
+  - id: UNI-002
+    sql: SELECT o.id FROM "Orders" o WHERE o.tenant_id = 1
+    category: unicode_identifiers
+    reason: unauthorized_table
+    classification: policy_violation
+    expected_by_dialect: {sqlite: allow}
+    explanation: >-
+      PostgreSQL treats quoted "Orders" as a different (unknown) table; SQLite identifiers are
+      case-insensitive, so it is the same table there.
+  - id: UNI-003
+    sql: SELECT o.id FROM оrders o WHERE o.tenant_id = 1
+    category: unicode_identifiers
+    reason: unauthorized_table
+    explanation: Cyrillic 'о' homoglyph makes a different identifier.
+  - id: UNI-004
+    sql: SELECT o.id FROM orders o WHERE o.tenant_id = 1 AND o.status = 'Zoë 😀'
+    category: unicode_identifiers
+    expected: allow
+    reason: none
+    explanation: Non-ASCII string literal.
+  - id: UNI-005
+    sql: "SELECT o.id AS \"Bestellnummer ü\" FROM orders o WHERE o.tenant_id = 1"
+    category: unicode_identifiers
+    expected: allow
+    reason: none
+    explanation: Non-ASCII quoted alias.
+  - id: UNI-006
+    sql: "SELECT o.id FROM \"order s\" o WHERE o.tenant_id = 1"
+    category: unicode_identifiers
+    reason: unauthorized_table
+    classification: policy_violation
+    explanation: Quoted identifier with a space is a different table.
+  - id: UNI-007
+    sql: "SELECT c.\"EMAIL\" FROM customers c WHERE c.tenant_id = 1"
+    category: unicode_identifiers
+    reason: unresolvable
+    classification: policy_violation
+    expected_by_dialect: {sqlite: allow}
+    explanation: In PostgreSQL quoted "EMAIL" is not the column email; SQLite folds case.
+  - id: UNI-008
+    sql: "SELECT o.id FROM ORDERS o WHERE O.TENANT_ID = 1"
+    category: unicode_identifiers
+    expected: allow
+    reason: none
+    explanation: Unquoted identifiers fold to lower case.