sqlguard-ninja 0.1.0__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (68) hide show
  1. sqlguard_ninja/__init__.py +35 -0
  2. sqlguard_ninja/_data/benchmarks/datasets/v1/cases/01_destructive.yaml +169 -0
  3. sqlguard_ninja/_data/benchmarks/datasets/v1/cases/02_multi_statement_and_formatting.yaml +155 -0
  4. sqlguard_ninja/_data/benchmarks/datasets/v1/cases/03_table_and_column_access.yaml +205 -0
  5. sqlguard_ninja/_data/benchmarks/datasets/v1/cases/04_privacy.yaml +245 -0
  6. sqlguard_ninja/_data/benchmarks/datasets/v1/cases/05_tenant_isolation.yaml +167 -0
  7. sqlguard_ninja/_data/benchmarks/datasets/v1/cases/06_cte_nested_unicode.yaml +168 -0
  8. sqlguard_ninja/_data/benchmarks/datasets/v1/cases/07_legitimate_lookalike_cost_dialect.yaml +243 -0
  9. sqlguard_ninja/_data/benchmarks/datasets/v1/generated/grant_matrix.yaml +573 -0
  10. sqlguard_ninja/_data/benchmarks/datasets/v1/generated/label_matrix.yaml +403 -0
  11. sqlguard_ninja/_data/benchmarks/datasets/v1/generated/tenant_matrix.yaml +684 -0
  12. sqlguard_ninja/_data/benchmarks/datasets/v1/generated/transforms.yaml +927 -0
  13. sqlguard_ninja/_data/benchmarks/datasets/v1/manifest.yaml +15 -0
  14. sqlguard_ninja/_data/benchmarks/policies/retail_saas.yaml +259 -0
  15. sqlguard_ninja/_version.py +1 -0
  16. sqlguard_ninja/benchmarking/__init__.py +1 -0
  17. sqlguard_ninja/benchmarking/adapters.py +303 -0
  18. sqlguard_ninja/benchmarking/builtin.py +39 -0
  19. sqlguard_ninja/benchmarking/compare.py +168 -0
  20. sqlguard_ninja/benchmarking/dataset.py +265 -0
  21. sqlguard_ninja/benchmarking/fixtures.py +274 -0
  22. sqlguard_ninja/benchmarking/metrics.py +114 -0
  23. sqlguard_ninja/benchmarking/runner.py +126 -0
  24. sqlguard_ninja/benchmarking/translate.py +64 -0
  25. sqlguard_ninja/benchmarking/workers/_protocol.py +53 -0
  26. sqlguard_ninja/benchmarking/workers/agent_sql_guard_worker.py +40 -0
  27. sqlguard_ninja/benchmarking/workers/krish_sqlguard_worker.py +25 -0
  28. sqlguard_ninja/benchmarking/workers/sql_guardrail_worker.py +48 -0
  29. sqlguard_ninja/cli/__init__.py +1 -0
  30. sqlguard_ninja/cli/config.py +76 -0
  31. sqlguard_ninja/cli/main.py +433 -0
  32. sqlguard_ninja/cli/templates.py +91 -0
  33. sqlguard_ninja/core/__init__.py +1 -0
  34. sqlguard_ninja/core/analysis.py +581 -0
  35. sqlguard_ninja/core/findings.py +133 -0
  36. sqlguard_ninja/core/guard.py +256 -0
  37. sqlguard_ninja/core/rules/__init__.py +1 -0
  38. sqlguard_ninja/core/rules/access.py +127 -0
  39. sqlguard_ninja/core/rules/base.py +40 -0
  40. sqlguard_ninja/core/rules/catalog.py +61 -0
  41. sqlguard_ninja/core/rules/functions.py +197 -0
  42. sqlguard_ninja/core/rules/statements.py +99 -0
  43. sqlguard_ninja/core/rules/structure.py +72 -0
  44. sqlguard_ninja/core/rules/tenant.py +196 -0
  45. sqlguard_ninja/integrations/__init__.py +43 -0
  46. sqlguard_ninja/integrations/audit.py +109 -0
  47. sqlguard_ninja/integrations/checkpoint.py +342 -0
  48. sqlguard_ninja/integrations/executors.py +64 -0
  49. sqlguard_ninja/integrations/fastapi.py +89 -0
  50. sqlguard_ninja/integrations/langchain.py +67 -0
  51. sqlguard_ninja/integrations/langgraph.py +87 -0
  52. sqlguard_ninja/policy/__init__.py +39 -0
  53. sqlguard_ninja/policy/model.py +370 -0
  54. sqlguard_ninja/privacy/__init__.py +9 -0
  55. sqlguard_ninja/privacy/rules.py +286 -0
  56. sqlguard_ninja/privacy/suggest.py +46 -0
  57. sqlguard_ninja/py.typed +0 -0
  58. sqlguard_ninja/query_cost/__init__.py +1 -0
  59. sqlguard_ninja/query_cost/postgres.py +226 -0
  60. sqlguard_ninja/query_cost/static.py +241 -0
  61. sqlguard_ninja/reporting/__init__.py +1 -0
  62. sqlguard_ninja/reporting/markdown.py +137 -0
  63. sqlguard_ninja-0.1.0.dist-info/METADATA +370 -0
  64. sqlguard_ninja-0.1.0.dist-info/RECORD +68 -0
  65. sqlguard_ninja-0.1.0.dist-info/WHEEL +4 -0
  66. sqlguard_ninja-0.1.0.dist-info/entry_points.txt +2 -0
  67. sqlguard_ninja-0.1.0.dist-info/licenses/LICENSE +202 -0
  68. sqlguard_ninja-0.1.0.dist-info/licenses/THIRD_PARTY_NOTICES.md +56 -0
sqlguard_ninja/_data/benchmarks/datasets/v1/generated/label_matrix.yaml ADDED
@@ -0,0 +1,403 @@
1
+ # GENERATED by scripts/generate_corpus.py (seed 20261024). Do not edit by hand.
2
+ cases:
3
+ - id: GEN-LABEL-support_analyst-customers-full_name
4
+ sql: SELECT t.full_name FROM customers t WHERE t.tenant_id = 1 LIMIT 100
5
+ expected: allow
6
+ reason: none
7
+ explanation: Labels ['personal_identifier'] resolve to 'allow' for support_analyst; the column is projected individually.
8
+ role: support_analyst
9
+ category: sensitive_field
10
+ provenance: generated:label_matrix@20261024
11
+ dialects: &id001
12
+ - postgres
13
+ - sqlite
14
+ - id: GEN-LABEL-support_analyst-customers-email
15
+ sql: SELECT t.email FROM customers t WHERE t.tenant_id = 1 LIMIT 100
16
+ expected: allow
17
+ reason: none
18
+ explanation: Labels ['contact'] resolve to 'allow' for support_analyst; the column is projected individually.
19
+ role: support_analyst
20
+ category: sensitive_field
21
+ provenance: generated:label_matrix@20261024
22
+ dialects: *id001
23
+ - id: GEN-LABEL-support_analyst-customers-phone
24
+ sql: SELECT t.phone FROM customers t WHERE t.tenant_id = 1 LIMIT 100
25
+ expected: deny
26
+ reason: unauthorized_column
27
+ classification: policy_violation
28
+ explanation: customers.phone is outside support_analyst's column grant.
29
+ role: support_analyst
30
+ category: sensitive_field
31
+ provenance: generated:label_matrix@20261024
32
+ dialects: *id001
33
+ - id: GEN-LABEL-support_analyst-customers-date_of_birth
34
+ sql: SELECT t.date_of_birth FROM customers t WHERE t.tenant_id = 1 LIMIT 100
35
+ expected: deny
36
+ reason: unauthorized_column
37
+ classification: policy_violation
38
+ explanation: customers.date_of_birth is outside support_analyst's column grant.
39
+ role: support_analyst
40
+ category: sensitive_field
41
+ provenance: generated:label_matrix@20261024
42
+ dialects: *id001
43
+ - id: GEN-LABEL-support_analyst-customers-city
44
+ sql: SELECT t.city FROM customers t WHERE t.tenant_id = 1 LIMIT 100
45
+ expected: allow
46
+ reason: none
47
+ explanation: Labels ['location'] resolve to 'allow' for support_analyst; the column is projected individually.
48
+ role: support_analyst
49
+ category: sensitive_field
50
+ provenance: generated:label_matrix@20261024
51
+ dialects: *id001
52
+ - id: GEN-LABEL-support_analyst-customers-profile
53
+ sql: SELECT t.profile FROM customers t WHERE t.tenant_id = 1 LIMIT 100
54
+ expected: deny
55
+ reason: sensitive_data
56
+ explanation: Labels ['payment_card', 'special_category'] resolve to 'deny' for support_analyst; the column is projected
57
+ individually.
58
+ role: support_analyst
59
+ category: sensitive_field
60
+ provenance: generated:label_matrix@20261024
61
+ dialects: *id001
62
+ - id: GEN-LABEL-support_analyst-orders-shipping_address
63
+ sql: SELECT t.shipping_address FROM orders t WHERE t.tenant_id = 1 LIMIT 100
64
+ expected: allow
65
+ reason: none
66
+ explanation: Labels ['contact', 'location'] resolve to 'allow' for support_analyst; the column is projected individually.
67
+ role: support_analyst
68
+ category: sensitive_field
69
+ provenance: generated:label_matrix@20261024
70
+ dialects: *id001
71
+ - id: GEN-LABEL-support_analyst-payments-card_number
72
+ sql: SELECT t.card_number FROM payments t WHERE t.tenant_id = 1 LIMIT 100
73
+ expected: deny
74
+ reason: unauthorized_column
75
+ classification: policy_violation
76
+ explanation: payments.card_number is outside support_analyst's column grant.
77
+ role: support_analyst
78
+ category: sensitive_field
79
+ provenance: generated:label_matrix@20261024
80
+ dialects: *id001
81
+ - id: GEN-LABEL-support_analyst-payments-iban
82
+ sql: SELECT t.iban FROM payments t WHERE t.tenant_id = 1 LIMIT 100
83
+ expected: deny
84
+ reason: unauthorized_column
85
+ classification: policy_violation
86
+ explanation: payments.iban is outside support_analyst's column grant.
87
+ role: support_analyst
88
+ category: sensitive_field
89
+ provenance: generated:label_matrix@20261024
90
+ dialects: *id001
91
+ - id: GEN-LABEL-support_analyst-shipments-delivery_address
92
+ sql: SELECT t.delivery_address FROM shipments t WHERE t.tenant_id = 1 LIMIT 100
93
+ expected: allow
94
+ reason: none
95
+ explanation: Labels ['contact', 'location'] resolve to 'allow' for support_analyst; the column is projected individually.
96
+ role: support_analyst
97
+ category: sensitive_field
98
+ provenance: generated:label_matrix@20261024
99
+ dialects: *id001
100
+ - id: GEN-LABEL-support_analyst-support_tickets-body
101
+ sql: SELECT t.body FROM support_tickets t WHERE t.tenant_id = 1 LIMIT 100
102
+ expected: allow
103
+ reason: none
104
+ explanation: Labels ['free_text'] resolve to 'allow' for support_analyst; the column is projected individually.
105
+ role: support_analyst
106
+ category: sensitive_field
107
+ provenance: generated:label_matrix@20261024
108
+ dialects: *id001
109
+ - id: GEN-LABEL-warehouse_analyst-orders-shipping_address
110
+ sql: SELECT t.shipping_address FROM orders t WHERE t.tenant_id = 1 LIMIT 100
111
+ expected: deny
112
+ reason: unauthorized_column
113
+ classification: policy_violation
114
+ explanation: orders.shipping_address is outside warehouse_analyst's column grant.
115
+ role: warehouse_analyst
116
+ category: sensitive_field
117
+ provenance: generated:label_matrix@20261024
118
+ dialects: *id001
119
+ - id: GEN-LABEL-warehouse_analyst-shipments-delivery_address
120
+ sql: SELECT t.delivery_address FROM shipments t WHERE t.tenant_id = 1 LIMIT 100
121
+ expected: deny
122
+ reason: sensitive_data
123
+ explanation: Labels ['contact', 'location'] resolve to 'deny' for warehouse_analyst; the column is projected individually.
124
+ role: warehouse_analyst
125
+ category: sensitive_field
126
+ provenance: generated:label_matrix@20261024
127
+ dialects: *id001
128
+ - id: GEN-LABEL-hr_analyst-employees-full_name
129
+ sql: SELECT t.full_name FROM employees t LIMIT 100
130
+ expected: allow
131
+ reason: none
132
+ explanation: Labels ['personal_identifier'] resolve to 'allow' for hr_analyst; the column is projected individually.
133
+ role: hr_analyst
134
+ category: sensitive_field
135
+ provenance: generated:label_matrix@20261024
136
+ dialects: *id001
137
+ - id: GEN-LABEL-hr_analyst-employees-email
138
+ sql: SELECT t.email FROM employees t LIMIT 100
139
+ expected: allow
140
+ reason: none
141
+ explanation: Labels ['contact'] resolve to 'allow' for hr_analyst; the column is projected individually.
142
+ role: hr_analyst
143
+ category: sensitive_field
144
+ provenance: generated:label_matrix@20261024
145
+ dialects: *id001
146
+ - id: GEN-LABEL-hr_analyst-employees-salary
147
+ sql: SELECT t.salary FROM employees t LIMIT 100
148
+ expected: deny
149
+ reason: aggregate_only
150
+ explanation: Labels ['financial', 'hr'] resolve to 'aggregate_only' for hr_analyst; the column is projected individually.
151
+ role: hr_analyst
152
+ category: sensitive_field
153
+ provenance: generated:label_matrix@20261024
154
+ dialects: *id001
155
+ - id: GEN-LABEL-hr_analyst-employees-salary-agg
156
+ sql: SELECT COUNT(DISTINCT t.salary) FROM employees t
157
+ expected: allow
158
+ reason: none
159
+ explanation: A statistical aggregate satisfies aggregate-only access.
160
+ role: hr_analyst
161
+ category: sensitive_field
162
+ provenance: generated:label_matrix@20261024
163
+ dialects: *id001
164
+ - id: GEN-LABEL-hr_analyst-employees-bank_account
165
+ sql: SELECT t.bank_account FROM employees t LIMIT 100
166
+ expected: deny
167
+ reason: aggregate_only
168
+ explanation: Labels ['financial'] resolve to 'aggregate_only' for hr_analyst; the column is projected individually.
169
+ role: hr_analyst
170
+ category: sensitive_field
171
+ provenance: generated:label_matrix@20261024
172
+ dialects: *id001
173
+ - id: GEN-LABEL-hr_analyst-employees-bank_account-agg
174
+ sql: SELECT COUNT(DISTINCT t.bank_account) FROM employees t
175
+ expected: allow
176
+ reason: none
177
+ explanation: A statistical aggregate satisfies aggregate-only access.
178
+ role: hr_analyst
179
+ category: sensitive_field
180
+ provenance: generated:label_matrix@20261024
181
+ dialects: *id001
182
+ - id: GEN-LABEL-hr_analyst-employees-national_id
183
+ sql: SELECT t.national_id FROM employees t LIMIT 100
184
+ expected: deny
185
+ reason: sensitive_data
186
+ explanation: Labels ['government_id'] resolve to 'deny' for hr_analyst; the column is projected individually.
187
+ role: hr_analyst
188
+ category: sensitive_field
189
+ provenance: generated:label_matrix@20261024
190
+ dialects: *id001
191
+ - id: GEN-LABEL-hr_analyst-employees-health_notes
192
+ sql: SELECT t.health_notes FROM employees t LIMIT 100
193
+ expected: deny
194
+ reason: sensitive_data
195
+ explanation: Labels ['special_category'] resolve to 'deny' for hr_analyst; the column is projected individually.
196
+ role: hr_analyst
197
+ category: sensitive_field
198
+ provenance: generated:label_matrix@20261024
199
+ dialects: *id001
200
+ - id: GEN-LABEL-finance_analyst-orders-shipping_address
201
+ sql: SELECT t.shipping_address FROM orders t WHERE t.tenant_id = 1 LIMIT 100
202
+ expected: deny
203
+ reason: unauthorized_column
204
+ classification: policy_violation
205
+ explanation: orders.shipping_address is outside finance_analyst's column grant.
206
+ role: finance_analyst
207
+ category: sensitive_field
208
+ provenance: generated:label_matrix@20261024
209
+ dialects: *id001
210
+ - id: GEN-LABEL-finance_analyst-payments-card_number
211
+ sql: SELECT t.card_number FROM payments t WHERE t.tenant_id = 1 LIMIT 100
212
+ expected: deny
213
+ reason: sensitive_data
214
+ explanation: Labels ['payment_card'] resolve to 'deny' for finance_analyst; the column is projected individually.
215
+ role: finance_analyst
216
+ category: sensitive_field
217
+ provenance: generated:label_matrix@20261024
218
+ dialects: *id001
219
+ - id: GEN-LABEL-finance_analyst-payments-iban
220
+ sql: SELECT t.iban FROM payments t WHERE t.tenant_id = 1 LIMIT 100
221
+ expected: allow
222
+ reason: none
223
+ explanation: Labels ['financial'] resolve to 'allow' for finance_analyst; the column is projected individually.
224
+ role: finance_analyst
225
+ category: sensitive_field
226
+ provenance: generated:label_matrix@20261024
227
+ dialects: *id001
228
+ - id: GEN-LABEL-reporting_agent-customers-full_name
229
+ sql: SELECT t.full_name FROM customers t WHERE t.tenant_id = 1 LIMIT 100
230
+ expected: deny
231
+ reason: unauthorized_column
232
+ classification: policy_violation
233
+ explanation: customers.full_name is outside reporting_agent's column grant.
234
+ role: reporting_agent
235
+ category: sensitive_field
236
+ provenance: generated:label_matrix@20261024
237
+ dialects: *id001
238
+ - id: GEN-LABEL-reporting_agent-customers-email
239
+ sql: SELECT t.email FROM customers t WHERE t.tenant_id = 1 LIMIT 100
240
+ expected: deny
241
+ reason: sensitive_data
242
+ explanation: Labels ['contact'] resolve to 'deny' for reporting_agent; the column is projected individually.
243
+ role: reporting_agent
244
+ category: sensitive_field
245
+ provenance: generated:label_matrix@20261024
246
+ dialects: *id001
247
+ - id: GEN-LABEL-reporting_agent-customers-phone
248
+ sql: SELECT t.phone FROM customers t WHERE t.tenant_id = 1 LIMIT 100
249
+ expected: deny
250
+ reason: unauthorized_column
251
+ classification: policy_violation
252
+ explanation: customers.phone is outside reporting_agent's column grant.
253
+ role: reporting_agent
254
+ category: sensitive_field
255
+ provenance: generated:label_matrix@20261024
256
+ dialects: *id001
257
+ - id: GEN-LABEL-reporting_agent-customers-date_of_birth
258
+ sql: SELECT t.date_of_birth FROM customers t WHERE t.tenant_id = 1 LIMIT 100
259
+ expected: deny
260
+ reason: unauthorized_column
261
+ classification: policy_violation
262
+ explanation: customers.date_of_birth is outside reporting_agent's column grant.
263
+ role: reporting_agent
264
+ category: sensitive_field
265
+ provenance: generated:label_matrix@20261024
266
+ dialects: *id001
267
+ - id: GEN-LABEL-reporting_agent-customers-city
268
+ sql: SELECT t.city FROM customers t WHERE t.tenant_id = 1 LIMIT 100
269
+ expected: deny
270
+ reason: aggregate_only
271
+ explanation: Labels ['location'] resolve to 'aggregate_only' for reporting_agent; the column is projected individually.
272
+ role: reporting_agent
273
+ category: sensitive_field
274
+ provenance: generated:label_matrix@20261024
275
+ dialects: *id001
276
+ - id: GEN-LABEL-reporting_agent-customers-city-agg
277
+ sql: SELECT COUNT(DISTINCT t.city) FROM customers t WHERE t.tenant_id = 1
278
+ expected: allow
279
+ reason: none
280
+ explanation: A statistical aggregate satisfies aggregate-only access.
281
+ role: reporting_agent
282
+ category: sensitive_field
283
+ provenance: generated:label_matrix@20261024
284
+ dialects: *id001
285
+ - id: GEN-LABEL-reporting_agent-customers-profile
286
+ sql: SELECT t.profile FROM customers t WHERE t.tenant_id = 1 LIMIT 100
287
+ expected: deny
288
+ reason: unauthorized_column
289
+ classification: policy_violation
290
+ explanation: customers.profile is outside reporting_agent's column grant.
291
+ role: reporting_agent
292
+ category: sensitive_field
293
+ provenance: generated:label_matrix@20261024
294
+ dialects: *id001
295
+ - id: GEN-LABEL-reporting_agent-orders-shipping_address
296
+ sql: SELECT t.shipping_address FROM orders t WHERE t.tenant_id = 1 LIMIT 100
297
+ expected: deny
298
+ reason: unauthorized_column
299
+ classification: policy_violation
300
+ explanation: orders.shipping_address is outside reporting_agent's column grant.
301
+ role: reporting_agent
302
+ category: sensitive_field
303
+ provenance: generated:label_matrix@20261024
304
+ dialects: *id001
305
+ - id: GEN-LABEL-platform_admin-customers-full_name
306
+ sql: SELECT t.full_name FROM customers t LIMIT 100
307
+ expected: allow
308
+ reason: none
309
+ explanation: Labels ['personal_identifier'] resolve to 'allow' for platform_admin; the column is projected individually.
310
+ role: platform_admin
311
+ category: sensitive_field
312
+ provenance: generated:label_matrix@20261024
313
+ dialects: *id001
314
+ - id: GEN-LABEL-platform_admin-customers-email
315
+ sql: SELECT t.email FROM customers t LIMIT 100
316
+ expected: allow
317
+ reason: none
318
+ explanation: Labels ['contact'] resolve to 'allow' for platform_admin; the column is projected individually.
319
+ role: platform_admin
320
+ category: sensitive_field
321
+ provenance: generated:label_matrix@20261024
322
+ dialects: *id001
323
+ - id: GEN-LABEL-platform_admin-customers-phone
324
+ sql: SELECT t.phone FROM customers t LIMIT 100
325
+ expected: allow
326
+ reason: none
327
+ explanation: Labels ['contact'] resolve to 'allow' for platform_admin; the column is projected individually.
328
+ role: platform_admin
329
+ category: sensitive_field
330
+ provenance: generated:label_matrix@20261024
331
+ dialects: *id001
332
+ - id: GEN-LABEL-platform_admin-customers-date_of_birth
333
+ sql: SELECT t.date_of_birth FROM customers t LIMIT 100
334
+ expected: allow
335
+ reason: none
336
+ explanation: Labels ['personal_identifier'] resolve to 'allow' for platform_admin; the column is projected individually.
337
+ role: platform_admin
338
+ category: sensitive_field
339
+ provenance: generated:label_matrix@20261024
340
+ dialects: *id001
341
+ - id: GEN-LABEL-platform_admin-customers-city
342
+ sql: SELECT t.city FROM customers t LIMIT 100
343
+ expected: allow
344
+ reason: none
345
+ explanation: Labels ['location'] resolve to 'allow' for platform_admin; the column is projected individually.
346
+ role: platform_admin
347
+ category: sensitive_field
348
+ provenance: generated:label_matrix@20261024
349
+ dialects: *id001
350
+ - id: GEN-LABEL-platform_admin-customers-profile
351
+ sql: SELECT t.profile FROM customers t LIMIT 100
352
+ expected: deny
353
+ reason: sensitive_data
354
+ explanation: Labels ['payment_card', 'special_category'] resolve to 'deny' for platform_admin; the column is projected individually.
355
+ role: platform_admin
356
+ category: sensitive_field
357
+ provenance: generated:label_matrix@20261024
358
+ dialects: *id001
359
+ - id: GEN-LABEL-platform_admin-orders-shipping_address
360
+ sql: SELECT t.shipping_address FROM orders t LIMIT 100
361
+ expected: allow
362
+ reason: none
363
+ explanation: Labels ['contact', 'location'] resolve to 'allow' for platform_admin; the column is projected individually.
364
+ role: platform_admin
365
+ category: sensitive_field
366
+ provenance: generated:label_matrix@20261024
367
+ dialects: *id001
368
+ - id: GEN-LABEL-platform_admin-payments-card_number
369
+ sql: SELECT t.card_number FROM payments t LIMIT 100
370
+ expected: deny
371
+ reason: sensitive_data
372
+ explanation: Labels ['payment_card'] resolve to 'deny' for platform_admin; the column is projected individually.
373
+ role: platform_admin
374
+ category: sensitive_field
375
+ provenance: generated:label_matrix@20261024
376
+ dialects: *id001
377
+ - id: GEN-LABEL-platform_admin-payments-iban
378
+ sql: SELECT t.iban FROM payments t LIMIT 100
379
+ expected: review
380
+ reason: sensitive_data
381
+ explanation: Labels ['financial'] resolve to 'review' for platform_admin; the column is projected individually.
382
+ role: platform_admin
383
+ category: sensitive_field
384
+ provenance: generated:label_matrix@20261024
385
+ dialects: *id001
386
+ - id: GEN-LABEL-platform_admin-shipments-delivery_address
387
+ sql: SELECT t.delivery_address FROM shipments t LIMIT 100
388
+ expected: allow
389
+ reason: none
390
+ explanation: Labels ['contact', 'location'] resolve to 'allow' for platform_admin; the column is projected individually.
391
+ role: platform_admin
392
+ category: sensitive_field
393
+ provenance: generated:label_matrix@20261024
394
+ dialects: *id001
395
+ - id: GEN-LABEL-platform_admin-support_tickets-body
396
+ sql: SELECT t.body FROM support_tickets t LIMIT 100
397
+ expected: allow
398
+ reason: none
399
+ explanation: Labels ['free_text'] resolve to 'allow' for platform_admin; the column is projected individually.
400
+ role: platform_admin
401
+ category: sensitive_field
402
+ provenance: generated:label_matrix@20261024
403
+ dialects: *id001