sqlguard-ninja 0.1.0__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (68) hide show
  1. sqlguard_ninja/__init__.py +35 -0
  2. sqlguard_ninja/_data/benchmarks/datasets/v1/cases/01_destructive.yaml +169 -0
  3. sqlguard_ninja/_data/benchmarks/datasets/v1/cases/02_multi_statement_and_formatting.yaml +155 -0
  4. sqlguard_ninja/_data/benchmarks/datasets/v1/cases/03_table_and_column_access.yaml +205 -0
  5. sqlguard_ninja/_data/benchmarks/datasets/v1/cases/04_privacy.yaml +245 -0
  6. sqlguard_ninja/_data/benchmarks/datasets/v1/cases/05_tenant_isolation.yaml +167 -0
  7. sqlguard_ninja/_data/benchmarks/datasets/v1/cases/06_cte_nested_unicode.yaml +168 -0
  8. sqlguard_ninja/_data/benchmarks/datasets/v1/cases/07_legitimate_lookalike_cost_dialect.yaml +243 -0
  9. sqlguard_ninja/_data/benchmarks/datasets/v1/generated/grant_matrix.yaml +573 -0
  10. sqlguard_ninja/_data/benchmarks/datasets/v1/generated/label_matrix.yaml +403 -0
  11. sqlguard_ninja/_data/benchmarks/datasets/v1/generated/tenant_matrix.yaml +684 -0
  12. sqlguard_ninja/_data/benchmarks/datasets/v1/generated/transforms.yaml +927 -0
  13. sqlguard_ninja/_data/benchmarks/datasets/v1/manifest.yaml +15 -0
  14. sqlguard_ninja/_data/benchmarks/policies/retail_saas.yaml +259 -0
  15. sqlguard_ninja/_version.py +1 -0
  16. sqlguard_ninja/benchmarking/__init__.py +1 -0
  17. sqlguard_ninja/benchmarking/adapters.py +303 -0
  18. sqlguard_ninja/benchmarking/builtin.py +39 -0
  19. sqlguard_ninja/benchmarking/compare.py +168 -0
  20. sqlguard_ninja/benchmarking/dataset.py +265 -0
  21. sqlguard_ninja/benchmarking/fixtures.py +274 -0
  22. sqlguard_ninja/benchmarking/metrics.py +114 -0
  23. sqlguard_ninja/benchmarking/runner.py +126 -0
  24. sqlguard_ninja/benchmarking/translate.py +64 -0
  25. sqlguard_ninja/benchmarking/workers/_protocol.py +53 -0
  26. sqlguard_ninja/benchmarking/workers/agent_sql_guard_worker.py +40 -0
  27. sqlguard_ninja/benchmarking/workers/krish_sqlguard_worker.py +25 -0
  28. sqlguard_ninja/benchmarking/workers/sql_guardrail_worker.py +48 -0
  29. sqlguard_ninja/cli/__init__.py +1 -0
  30. sqlguard_ninja/cli/config.py +76 -0
  31. sqlguard_ninja/cli/main.py +433 -0
  32. sqlguard_ninja/cli/templates.py +91 -0
  33. sqlguard_ninja/core/__init__.py +1 -0
  34. sqlguard_ninja/core/analysis.py +581 -0
  35. sqlguard_ninja/core/findings.py +133 -0
  36. sqlguard_ninja/core/guard.py +256 -0
  37. sqlguard_ninja/core/rules/__init__.py +1 -0
  38. sqlguard_ninja/core/rules/access.py +127 -0
  39. sqlguard_ninja/core/rules/base.py +40 -0
  40. sqlguard_ninja/core/rules/catalog.py +61 -0
  41. sqlguard_ninja/core/rules/functions.py +197 -0
  42. sqlguard_ninja/core/rules/statements.py +99 -0
  43. sqlguard_ninja/core/rules/structure.py +72 -0
  44. sqlguard_ninja/core/rules/tenant.py +196 -0
  45. sqlguard_ninja/integrations/__init__.py +43 -0
  46. sqlguard_ninja/integrations/audit.py +109 -0
  47. sqlguard_ninja/integrations/checkpoint.py +342 -0
  48. sqlguard_ninja/integrations/executors.py +64 -0
  49. sqlguard_ninja/integrations/fastapi.py +89 -0
  50. sqlguard_ninja/integrations/langchain.py +67 -0
  51. sqlguard_ninja/integrations/langgraph.py +87 -0
  52. sqlguard_ninja/policy/__init__.py +39 -0
  53. sqlguard_ninja/policy/model.py +370 -0
  54. sqlguard_ninja/privacy/__init__.py +9 -0
  55. sqlguard_ninja/privacy/rules.py +286 -0
  56. sqlguard_ninja/privacy/suggest.py +46 -0
  57. sqlguard_ninja/py.typed +0 -0
  58. sqlguard_ninja/query_cost/__init__.py +1 -0
  59. sqlguard_ninja/query_cost/postgres.py +226 -0
  60. sqlguard_ninja/query_cost/static.py +241 -0
  61. sqlguard_ninja/reporting/__init__.py +1 -0
  62. sqlguard_ninja/reporting/markdown.py +137 -0
  63. sqlguard_ninja-0.1.0.dist-info/METADATA +370 -0
  64. sqlguard_ninja-0.1.0.dist-info/RECORD +68 -0
  65. sqlguard_ninja-0.1.0.dist-info/WHEEL +4 -0
  66. sqlguard_ninja-0.1.0.dist-info/entry_points.txt +2 -0
  67. sqlguard_ninja-0.1.0.dist-info/licenses/LICENSE +202 -0
  68. sqlguard_ninja-0.1.0.dist-info/licenses/THIRD_PARTY_NOTICES.md +56 -0
sqlguard_ninja/_data/benchmarks/datasets/v1/generated/grant_matrix.yaml ADDED
@@ -0,0 +1,573 @@
1
+ # GENERATED by scripts/generate_corpus.py (seed 20261024). Do not edit by hand.
2
+ cases:
3
+ - id: GEN-GRANT-support_analyst-tenants
4
+ role: support_analyst
5
+ sql: SELECT t.id FROM tenants t LIMIT 100
6
+ category: unauthorized_table
7
+ expected: deny
8
+ reason: unauthorized_table
9
+ classification: policy_violation
10
+ provenance: generated:grant_matrix@20261024
11
+ explanation: Role support_analyst has no grant on tenants.
12
+ dialects: &id001
13
+ - postgres
14
+ - sqlite
15
+ - id: GEN-GRANT-support_analyst-customers
16
+ role: support_analyst
17
+ sql: SELECT t.id FROM customers t WHERE t.tenant_id = 1 LIMIT 100
18
+ category: unauthorized_table
19
+ expected: allow
20
+ reason: none
21
+ provenance: generated:grant_matrix@20261024
22
+ explanation: Role support_analyst has grant on customers.
23
+ dialects: *id001
24
+ - id: GEN-GRANT-support_analyst-orders
25
+ role: support_analyst
26
+ sql: SELECT t.id FROM orders t WHERE t.tenant_id = 1 LIMIT 100
27
+ category: unauthorized_table
28
+ expected: allow
29
+ reason: none
30
+ provenance: generated:grant_matrix@20261024
31
+ explanation: Role support_analyst has grant on orders.
32
+ dialects: *id001
33
+ - id: GEN-GRANT-support_analyst-order_items
34
+ role: support_analyst
35
+ sql: SELECT t.id FROM order_items t WHERE t.tenant_id = 1 LIMIT 100
36
+ category: unauthorized_table
37
+ expected: allow
38
+ reason: none
39
+ provenance: generated:grant_matrix@20261024
40
+ explanation: Role support_analyst has grant on order_items.
41
+ dialects: *id001
42
+ - id: GEN-GRANT-support_analyst-products
43
+ role: support_analyst
44
+ sql: SELECT t.id FROM products t WHERE t.tenant_id = 1 LIMIT 100
45
+ category: unauthorized_table
46
+ expected: allow
47
+ reason: none
48
+ provenance: generated:grant_matrix@20261024
49
+ explanation: Role support_analyst has grant on products.
50
+ dialects: *id001
51
+ - id: GEN-GRANT-support_analyst-payments
52
+ role: support_analyst
53
+ sql: SELECT t.id FROM payments t WHERE t.tenant_id = 1 LIMIT 100
54
+ category: unauthorized_table
55
+ expected: allow
56
+ reason: none
57
+ provenance: generated:grant_matrix@20261024
58
+ explanation: Role support_analyst has grant on payments.
59
+ dialects: *id001
60
+ - id: GEN-GRANT-support_analyst-shipments
61
+ role: support_analyst
62
+ sql: SELECT t.id FROM shipments t WHERE t.tenant_id = 1 LIMIT 100
63
+ category: unauthorized_table
64
+ expected: allow
65
+ reason: none
66
+ provenance: generated:grant_matrix@20261024
67
+ explanation: Role support_analyst has grant on shipments.
68
+ dialects: *id001
69
+ - id: GEN-GRANT-support_analyst-warehouses
70
+ role: support_analyst
71
+ sql: SELECT t.id FROM warehouses t LIMIT 100
72
+ category: unauthorized_table
73
+ expected: deny
74
+ reason: unauthorized_table
75
+ classification: policy_violation
76
+ provenance: generated:grant_matrix@20261024
77
+ explanation: Role support_analyst has no grant on warehouses.
78
+ dialects: *id001
79
+ - id: GEN-GRANT-support_analyst-employees
80
+ role: support_analyst
81
+ sql: SELECT t.id FROM employees t LIMIT 100
82
+ category: unauthorized_table
83
+ expected: deny
84
+ reason: unauthorized_table
85
+ classification: policy_violation
86
+ provenance: generated:grant_matrix@20261024
87
+ explanation: Role support_analyst has no grant on employees.
88
+ dialects: *id001
89
+ - id: GEN-GRANT-support_analyst-support_tickets
90
+ role: support_analyst
91
+ sql: SELECT t.id FROM support_tickets t WHERE t.tenant_id = 1 LIMIT 100
92
+ category: unauthorized_table
93
+ expected: allow
94
+ reason: none
95
+ provenance: generated:grant_matrix@20261024
96
+ explanation: Role support_analyst has grant on support_tickets.
97
+ dialects: *id001
98
+ - id: GEN-GRANT-warehouse_analyst-tenants
99
+ role: warehouse_analyst
100
+ sql: SELECT t.id FROM tenants t LIMIT 100
101
+ category: unauthorized_table
102
+ expected: deny
103
+ reason: unauthorized_table
104
+ classification: policy_violation
105
+ provenance: generated:grant_matrix@20261024
106
+ explanation: Role warehouse_analyst has no grant on tenants.
107
+ dialects: *id001
108
+ - id: GEN-GRANT-warehouse_analyst-customers
109
+ role: warehouse_analyst
110
+ sql: SELECT t.id FROM customers t WHERE t.tenant_id = 1 LIMIT 100
111
+ category: unauthorized_table
112
+ expected: deny
113
+ reason: unauthorized_table
114
+ classification: policy_violation
115
+ provenance: generated:grant_matrix@20261024
116
+ explanation: Role warehouse_analyst has no grant on customers.
117
+ dialects: *id001
118
+ - id: GEN-GRANT-warehouse_analyst-orders
119
+ role: warehouse_analyst
120
+ sql: SELECT t.id FROM orders t WHERE t.tenant_id = 1 LIMIT 100
121
+ category: unauthorized_table
122
+ expected: allow
123
+ reason: none
124
+ provenance: generated:grant_matrix@20261024
125
+ explanation: Role warehouse_analyst has grant on orders.
126
+ dialects: *id001
127
+ - id: GEN-GRANT-warehouse_analyst-order_items
128
+ role: warehouse_analyst
129
+ sql: SELECT t.id FROM order_items t WHERE t.tenant_id = 1 LIMIT 100
130
+ category: unauthorized_table
131
+ expected: allow
132
+ reason: none
133
+ provenance: generated:grant_matrix@20261024
134
+ explanation: Role warehouse_analyst has grant on order_items.
135
+ dialects: *id001
136
+ - id: GEN-GRANT-warehouse_analyst-products
137
+ role: warehouse_analyst
138
+ sql: SELECT t.id FROM products t WHERE t.tenant_id = 1 LIMIT 100
139
+ category: unauthorized_table
140
+ expected: allow
141
+ reason: none
142
+ provenance: generated:grant_matrix@20261024
143
+ explanation: Role warehouse_analyst has grant on products.
144
+ dialects: *id001
145
+ - id: GEN-GRANT-warehouse_analyst-payments
146
+ role: warehouse_analyst
147
+ sql: SELECT t.id FROM payments t WHERE t.tenant_id = 1 LIMIT 100
148
+ category: unauthorized_table
149
+ expected: deny
150
+ reason: unauthorized_table
151
+ classification: policy_violation
152
+ provenance: generated:grant_matrix@20261024
153
+ explanation: Role warehouse_analyst has no grant on payments.
154
+ dialects: *id001
155
+ - id: GEN-GRANT-warehouse_analyst-shipments
156
+ role: warehouse_analyst
157
+ sql: SELECT t.id FROM shipments t WHERE t.tenant_id = 1 LIMIT 100
158
+ category: unauthorized_table
159
+ expected: allow
160
+ reason: none
161
+ provenance: generated:grant_matrix@20261024
162
+ explanation: Role warehouse_analyst has grant on shipments.
163
+ dialects: *id001
164
+ - id: GEN-GRANT-warehouse_analyst-warehouses
165
+ role: warehouse_analyst
166
+ sql: SELECT t.id FROM warehouses t LIMIT 100
167
+ category: unauthorized_table
168
+ expected: allow
169
+ reason: none
170
+ provenance: generated:grant_matrix@20261024
171
+ explanation: Role warehouse_analyst has grant on warehouses.
172
+ dialects: *id001
173
+ - id: GEN-GRANT-warehouse_analyst-employees
174
+ role: warehouse_analyst
175
+ sql: SELECT t.id FROM employees t LIMIT 100
176
+ category: unauthorized_table
177
+ expected: deny
178
+ reason: unauthorized_table
179
+ classification: policy_violation
180
+ provenance: generated:grant_matrix@20261024
181
+ explanation: Role warehouse_analyst has no grant on employees.
182
+ dialects: *id001
183
+ - id: GEN-GRANT-warehouse_analyst-support_tickets
184
+ role: warehouse_analyst
185
+ sql: SELECT t.id FROM support_tickets t WHERE t.tenant_id = 1 LIMIT 100
186
+ category: unauthorized_table
187
+ expected: deny
188
+ reason: unauthorized_table
189
+ classification: policy_violation
190
+ provenance: generated:grant_matrix@20261024
191
+ explanation: Role warehouse_analyst has no grant on support_tickets.
192
+ dialects: *id001
193
+ - id: GEN-GRANT-hr_analyst-tenants
194
+ role: hr_analyst
195
+ sql: SELECT t.id FROM tenants t LIMIT 100
196
+ category: unauthorized_table
197
+ expected: deny
198
+ reason: unauthorized_table
199
+ classification: policy_violation
200
+ provenance: generated:grant_matrix@20261024
201
+ explanation: Role hr_analyst has no grant on tenants.
202
+ dialects: *id001
203
+ - id: GEN-GRANT-hr_analyst-customers
204
+ role: hr_analyst
205
+ sql: SELECT t.id FROM customers t LIMIT 100
206
+ category: unauthorized_table
207
+ expected: deny
208
+ reason: unauthorized_table
209
+ classification: policy_violation
210
+ provenance: generated:grant_matrix@20261024
211
+ explanation: Role hr_analyst has no grant on customers.
212
+ dialects: *id001
213
+ - id: GEN-GRANT-hr_analyst-orders
214
+ role: hr_analyst
215
+ sql: SELECT t.id FROM orders t LIMIT 100
216
+ category: unauthorized_table
217
+ expected: deny
218
+ reason: unauthorized_table
219
+ classification: policy_violation
220
+ provenance: generated:grant_matrix@20261024
221
+ explanation: Role hr_analyst has no grant on orders.
222
+ dialects: *id001
223
+ - id: GEN-GRANT-hr_analyst-order_items
224
+ role: hr_analyst
225
+ sql: SELECT t.id FROM order_items t LIMIT 100
226
+ category: unauthorized_table
227
+ expected: deny
228
+ reason: unauthorized_table
229
+ classification: policy_violation
230
+ provenance: generated:grant_matrix@20261024
231
+ explanation: Role hr_analyst has no grant on order_items.
232
+ dialects: *id001
233
+ - id: GEN-GRANT-hr_analyst-products
234
+ role: hr_analyst
235
+ sql: SELECT t.id FROM products t LIMIT 100
236
+ category: unauthorized_table
237
+ expected: deny
238
+ reason: unauthorized_table
239
+ classification: policy_violation
240
+ provenance: generated:grant_matrix@20261024
241
+ explanation: Role hr_analyst has no grant on products.
242
+ dialects: *id001
243
+ - id: GEN-GRANT-hr_analyst-payments
244
+ role: hr_analyst
245
+ sql: SELECT t.id FROM payments t LIMIT 100
246
+ category: unauthorized_table
247
+ expected: deny
248
+ reason: unauthorized_table
249
+ classification: policy_violation
250
+ provenance: generated:grant_matrix@20261024
251
+ explanation: Role hr_analyst has no grant on payments.
252
+ dialects: *id001
253
+ - id: GEN-GRANT-hr_analyst-shipments
254
+ role: hr_analyst
255
+ sql: SELECT t.id FROM shipments t LIMIT 100
256
+ category: unauthorized_table
257
+ expected: deny
258
+ reason: unauthorized_table
259
+ classification: policy_violation
260
+ provenance: generated:grant_matrix@20261024
261
+ explanation: Role hr_analyst has no grant on shipments.
262
+ dialects: *id001
263
+ - id: GEN-GRANT-hr_analyst-warehouses
264
+ role: hr_analyst
265
+ sql: SELECT t.id FROM warehouses t LIMIT 100
266
+ category: unauthorized_table
267
+ expected: allow
268
+ reason: none
269
+ provenance: generated:grant_matrix@20261024
270
+ explanation: Role hr_analyst has grant on warehouses.
271
+ dialects: *id001
272
+ - id: GEN-GRANT-hr_analyst-employees
273
+ role: hr_analyst
274
+ sql: SELECT t.id FROM employees t LIMIT 100
275
+ category: unauthorized_table
276
+ expected: allow
277
+ reason: none
278
+ provenance: generated:grant_matrix@20261024
279
+ explanation: Role hr_analyst has grant on employees.
280
+ dialects: *id001
281
+ - id: GEN-GRANT-hr_analyst-support_tickets
282
+ role: hr_analyst
283
+ sql: SELECT t.id FROM support_tickets t LIMIT 100
284
+ category: unauthorized_table
285
+ expected: deny
286
+ reason: unauthorized_table
287
+ classification: policy_violation
288
+ provenance: generated:grant_matrix@20261024
289
+ explanation: Role hr_analyst has no grant on support_tickets.
290
+ dialects: *id001
291
+ - id: GEN-GRANT-finance_analyst-tenants
292
+ role: finance_analyst
293
+ sql: SELECT t.id FROM tenants t LIMIT 100
294
+ category: unauthorized_table
295
+ expected: deny
296
+ reason: unauthorized_table
297
+ classification: policy_violation
298
+ provenance: generated:grant_matrix@20261024
299
+ explanation: Role finance_analyst has no grant on tenants.
300
+ dialects: *id001
301
+ - id: GEN-GRANT-finance_analyst-customers
302
+ role: finance_analyst
303
+ sql: SELECT t.id FROM customers t WHERE t.tenant_id = 1 LIMIT 100
304
+ category: unauthorized_table
305
+ expected: deny
306
+ reason: unauthorized_table
307
+ classification: policy_violation
308
+ provenance: generated:grant_matrix@20261024
309
+ explanation: Role finance_analyst has no grant on customers.
310
+ dialects: *id001
311
+ - id: GEN-GRANT-finance_analyst-orders
312
+ role: finance_analyst
313
+ sql: SELECT t.id FROM orders t WHERE t.tenant_id = 1 LIMIT 100
314
+ category: unauthorized_table
315
+ expected: allow
316
+ reason: none
317
+ provenance: generated:grant_matrix@20261024
318
+ explanation: Role finance_analyst has grant on orders.
319
+ dialects: *id001
320
+ - id: GEN-GRANT-finance_analyst-order_items
321
+ role: finance_analyst
322
+ sql: SELECT t.id FROM order_items t WHERE t.tenant_id = 1 LIMIT 100
323
+ category: unauthorized_table
324
+ expected: allow
325
+ reason: none
326
+ provenance: generated:grant_matrix@20261024
327
+ explanation: Role finance_analyst has grant on order_items.
328
+ dialects: *id001
329
+ - id: GEN-GRANT-finance_analyst-products
330
+ role: finance_analyst
331
+ sql: SELECT t.id FROM products t WHERE t.tenant_id = 1 LIMIT 100
332
+ category: unauthorized_table
333
+ expected: allow
334
+ reason: none
335
+ provenance: generated:grant_matrix@20261024
336
+ explanation: Role finance_analyst has grant on products.
337
+ dialects: *id001
338
+ - id: GEN-GRANT-finance_analyst-payments
339
+ role: finance_analyst
340
+ sql: SELECT t.id FROM payments t WHERE t.tenant_id = 1 LIMIT 100
341
+ category: unauthorized_table
342
+ expected: allow
343
+ reason: none
344
+ provenance: generated:grant_matrix@20261024
345
+ explanation: Role finance_analyst has grant on payments.
346
+ dialects: *id001
347
+ - id: GEN-GRANT-finance_analyst-shipments
348
+ role: finance_analyst
349
+ sql: SELECT t.id FROM shipments t WHERE t.tenant_id = 1 LIMIT 100
350
+ category: unauthorized_table
351
+ expected: deny
352
+ reason: unauthorized_table
353
+ classification: policy_violation
354
+ provenance: generated:grant_matrix@20261024
355
+ explanation: Role finance_analyst has no grant on shipments.
356
+ dialects: *id001
357
+ - id: GEN-GRANT-finance_analyst-warehouses
358
+ role: finance_analyst
359
+ sql: SELECT t.id FROM warehouses t LIMIT 100
360
+ category: unauthorized_table
361
+ expected: deny
362
+ reason: unauthorized_table
363
+ classification: policy_violation
364
+ provenance: generated:grant_matrix@20261024
365
+ explanation: Role finance_analyst has no grant on warehouses.
366
+ dialects: *id001
367
+ - id: GEN-GRANT-finance_analyst-employees
368
+ role: finance_analyst
369
+ sql: SELECT t.id FROM employees t LIMIT 100
370
+ category: unauthorized_table
371
+ expected: deny
372
+ reason: unauthorized_table
373
+ classification: policy_violation
374
+ provenance: generated:grant_matrix@20261024
375
+ explanation: Role finance_analyst has no grant on employees.
376
+ dialects: *id001
377
+ - id: GEN-GRANT-finance_analyst-support_tickets
378
+ role: finance_analyst
379
+ sql: SELECT t.id FROM support_tickets t WHERE t.tenant_id = 1 LIMIT 100
380
+ category: unauthorized_table
381
+ expected: deny
382
+ reason: unauthorized_table
383
+ classification: policy_violation
384
+ provenance: generated:grant_matrix@20261024
385
+ explanation: Role finance_analyst has no grant on support_tickets.
386
+ dialects: *id001
387
+ - id: GEN-GRANT-reporting_agent-tenants
388
+ role: reporting_agent
389
+ sql: SELECT t.id FROM tenants t LIMIT 100
390
+ category: unauthorized_table
391
+ expected: deny
392
+ reason: unauthorized_table
393
+ classification: policy_violation
394
+ provenance: generated:grant_matrix@20261024
395
+ explanation: Role reporting_agent has no grant on tenants.
396
+ dialects: *id001
397
+ - id: GEN-GRANT-reporting_agent-customers
398
+ role: reporting_agent
399
+ sql: SELECT t.id FROM customers t WHERE t.tenant_id = 1 LIMIT 100
400
+ category: unauthorized_table
401
+ expected: allow
402
+ reason: none
403
+ provenance: generated:grant_matrix@20261024
404
+ explanation: Role reporting_agent has grant on customers.
405
+ dialects: *id001
406
+ - id: GEN-GRANT-reporting_agent-orders
407
+ role: reporting_agent
408
+ sql: SELECT t.id FROM orders t WHERE t.tenant_id = 1 LIMIT 100
409
+ category: unauthorized_table
410
+ expected: allow
411
+ reason: none
412
+ provenance: generated:grant_matrix@20261024
413
+ explanation: Role reporting_agent has grant on orders.
414
+ dialects: *id001
415
+ - id: GEN-GRANT-reporting_agent-order_items
416
+ role: reporting_agent
417
+ sql: SELECT t.id FROM order_items t WHERE t.tenant_id = 1 LIMIT 100
418
+ category: unauthorized_table
419
+ expected: allow
420
+ reason: none
421
+ provenance: generated:grant_matrix@20261024
422
+ explanation: Role reporting_agent has grant on order_items.
423
+ dialects: *id001
424
+ - id: GEN-GRANT-reporting_agent-products
425
+ role: reporting_agent
426
+ sql: SELECT t.id FROM products t WHERE t.tenant_id = 1 LIMIT 100
427
+ category: unauthorized_table
428
+ expected: allow
429
+ reason: none
430
+ provenance: generated:grant_matrix@20261024
431
+ explanation: Role reporting_agent has grant on products.
432
+ dialects: *id001
433
+ - id: GEN-GRANT-reporting_agent-payments
434
+ role: reporting_agent
435
+ sql: SELECT t.id FROM payments t WHERE t.tenant_id = 1 LIMIT 100
436
+ category: unauthorized_table
437
+ expected: deny
438
+ reason: unauthorized_table
439
+ classification: policy_violation
440
+ provenance: generated:grant_matrix@20261024
441
+ explanation: Role reporting_agent has no grant on payments.
442
+ dialects: *id001
443
+ - id: GEN-GRANT-reporting_agent-shipments
444
+ role: reporting_agent
445
+ sql: SELECT t.id FROM shipments t WHERE t.tenant_id = 1 LIMIT 100
446
+ category: unauthorized_table
447
+ expected: deny
448
+ reason: unauthorized_table
449
+ classification: policy_violation
450
+ provenance: generated:grant_matrix@20261024
451
+ explanation: Role reporting_agent has no grant on shipments.
452
+ dialects: *id001
453
+ - id: GEN-GRANT-reporting_agent-warehouses
454
+ role: reporting_agent
455
+ sql: SELECT t.id FROM warehouses t LIMIT 100
456
+ category: unauthorized_table
457
+ expected: deny
458
+ reason: unauthorized_table
459
+ classification: policy_violation
460
+ provenance: generated:grant_matrix@20261024
461
+ explanation: Role reporting_agent has no grant on warehouses.
462
+ dialects: *id001
463
+ - id: GEN-GRANT-reporting_agent-employees
464
+ role: reporting_agent
465
+ sql: SELECT t.id FROM employees t LIMIT 100
466
+ category: unauthorized_table
467
+ expected: deny
468
+ reason: unauthorized_table
469
+ classification: policy_violation
470
+ provenance: generated:grant_matrix@20261024
471
+ explanation: Role reporting_agent has no grant on employees.
472
+ dialects: *id001
473
+ - id: GEN-GRANT-reporting_agent-support_tickets
474
+ role: reporting_agent
475
+ sql: SELECT t.id FROM support_tickets t WHERE t.tenant_id = 1 LIMIT 100
476
+ category: unauthorized_table
477
+ expected: deny
478
+ reason: unauthorized_table
479
+ classification: policy_violation
480
+ provenance: generated:grant_matrix@20261024
481
+ explanation: Role reporting_agent has no grant on support_tickets.
482
+ dialects: *id001
483
+ - id: GEN-GRANT-platform_admin-tenants
484
+ role: platform_admin
485
+ sql: SELECT t.id FROM tenants t LIMIT 100
486
+ category: unauthorized_table
487
+ expected: allow
488
+ reason: none
489
+ provenance: generated:grant_matrix@20261024
490
+ explanation: Role platform_admin has grant on tenants.
491
+ dialects: *id001
492
+ - id: GEN-GRANT-platform_admin-customers
493
+ role: platform_admin
494
+ sql: SELECT t.id FROM customers t LIMIT 100
495
+ category: unauthorized_table
496
+ expected: allow
497
+ reason: none
498
+ provenance: generated:grant_matrix@20261024
499
+ explanation: Role platform_admin has grant on customers.
500
+ dialects: *id001
501
+ - id: GEN-GRANT-platform_admin-orders
502
+ role: platform_admin
503
+ sql: SELECT t.id FROM orders t LIMIT 100
504
+ category: unauthorized_table
505
+ expected: allow
506
+ reason: none
507
+ provenance: generated:grant_matrix@20261024
508
+ explanation: Role platform_admin has grant on orders.
509
+ dialects: *id001
510
+ - id: GEN-GRANT-platform_admin-order_items
511
+ role: platform_admin
512
+ sql: SELECT t.id FROM order_items t LIMIT 100
513
+ category: unauthorized_table
514
+ expected: allow
515
+ reason: none
516
+ provenance: generated:grant_matrix@20261024
517
+ explanation: Role platform_admin has grant on order_items.
518
+ dialects: *id001
519
+ - id: GEN-GRANT-platform_admin-products
520
+ role: platform_admin
521
+ sql: SELECT t.id FROM products t LIMIT 100
522
+ category: unauthorized_table
523
+ expected: allow
524
+ reason: none
525
+ provenance: generated:grant_matrix@20261024
526
+ explanation: Role platform_admin has grant on products.
527
+ dialects: *id001
528
+ - id: GEN-GRANT-platform_admin-payments
529
+ role: platform_admin
530
+ sql: SELECT t.id FROM payments t LIMIT 100
531
+ category: unauthorized_table
532
+ expected: allow
533
+ reason: none
534
+ provenance: generated:grant_matrix@20261024
535
+ explanation: Role platform_admin has grant on payments.
536
+ dialects: *id001
537
+ - id: GEN-GRANT-platform_admin-shipments
538
+ role: platform_admin
539
+ sql: SELECT t.id FROM shipments t LIMIT 100
540
+ category: unauthorized_table
541
+ expected: allow
542
+ reason: none
543
+ provenance: generated:grant_matrix@20261024
544
+ explanation: Role platform_admin has grant on shipments.
545
+ dialects: *id001
546
+ - id: GEN-GRANT-platform_admin-warehouses
547
+ role: platform_admin
548
+ sql: SELECT t.id FROM warehouses t LIMIT 100
549
+ category: unauthorized_table
550
+ expected: allow
551
+ reason: none
552
+ provenance: generated:grant_matrix@20261024
553
+ explanation: Role platform_admin has grant on warehouses.
554
+ dialects: *id001
555
+ - id: GEN-GRANT-platform_admin-employees
556
+ role: platform_admin
557
+ sql: SELECT t.id FROM employees t LIMIT 100
558
+ category: unauthorized_table
559
+ expected: deny
560
+ reason: unauthorized_table
561
+ classification: policy_violation
562
+ provenance: generated:grant_matrix@20261024
563
+ explanation: Role platform_admin has no grant on employees.
564
+ dialects: *id001
565
+ - id: GEN-GRANT-platform_admin-support_tickets
566
+ role: platform_admin
567
+ sql: SELECT t.id FROM support_tickets t LIMIT 100
568
+ category: unauthorized_table
569
+ expected: allow
570
+ reason: none
571
+ provenance: generated:grant_matrix@20261024
572
+ explanation: Role platform_admin has grant on support_tickets.
573
+ dialects: *id001