PyPI - sqlguard-ninja - Versions diffs - 0.1.0__py3-none-any.whl - Mend

sqlguard-ninja 0.1.0__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (68) hide show

sqlguard_ninja/__init__.py +35 -0
sqlguard_ninja/_data/benchmarks/datasets/v1/cases/01_destructive.yaml +169 -0
sqlguard_ninja/_data/benchmarks/datasets/v1/cases/02_multi_statement_and_formatting.yaml +155 -0
sqlguard_ninja/_data/benchmarks/datasets/v1/cases/03_table_and_column_access.yaml +205 -0
sqlguard_ninja/_data/benchmarks/datasets/v1/cases/04_privacy.yaml +245 -0
sqlguard_ninja/_data/benchmarks/datasets/v1/cases/05_tenant_isolation.yaml +167 -0
sqlguard_ninja/_data/benchmarks/datasets/v1/cases/06_cte_nested_unicode.yaml +168 -0
sqlguard_ninja/_data/benchmarks/datasets/v1/cases/07_legitimate_lookalike_cost_dialect.yaml +243 -0
sqlguard_ninja/_data/benchmarks/datasets/v1/generated/grant_matrix.yaml +573 -0
sqlguard_ninja/_data/benchmarks/datasets/v1/generated/label_matrix.yaml +403 -0
sqlguard_ninja/_data/benchmarks/datasets/v1/generated/tenant_matrix.yaml +684 -0
sqlguard_ninja/_data/benchmarks/datasets/v1/generated/transforms.yaml +927 -0
sqlguard_ninja/_data/benchmarks/datasets/v1/manifest.yaml +15 -0
sqlguard_ninja/_data/benchmarks/policies/retail_saas.yaml +259 -0
sqlguard_ninja/_version.py +1 -0
sqlguard_ninja/benchmarking/__init__.py +1 -0
sqlguard_ninja/benchmarking/adapters.py +303 -0
sqlguard_ninja/benchmarking/builtin.py +39 -0
sqlguard_ninja/benchmarking/compare.py +168 -0
sqlguard_ninja/benchmarking/dataset.py +265 -0
sqlguard_ninja/benchmarking/fixtures.py +274 -0
sqlguard_ninja/benchmarking/metrics.py +114 -0
sqlguard_ninja/benchmarking/runner.py +126 -0
sqlguard_ninja/benchmarking/translate.py +64 -0
sqlguard_ninja/benchmarking/workers/_protocol.py +53 -0
sqlguard_ninja/benchmarking/workers/agent_sql_guard_worker.py +40 -0
sqlguard_ninja/benchmarking/workers/krish_sqlguard_worker.py +25 -0
sqlguard_ninja/benchmarking/workers/sql_guardrail_worker.py +48 -0
sqlguard_ninja/cli/__init__.py +1 -0
sqlguard_ninja/cli/config.py +76 -0
sqlguard_ninja/cli/main.py +433 -0
sqlguard_ninja/cli/templates.py +91 -0
sqlguard_ninja/core/__init__.py +1 -0
sqlguard_ninja/core/analysis.py +581 -0
sqlguard_ninja/core/findings.py +133 -0
sqlguard_ninja/core/guard.py +256 -0
sqlguard_ninja/core/rules/__init__.py +1 -0
sqlguard_ninja/core/rules/access.py +127 -0
sqlguard_ninja/core/rules/base.py +40 -0
sqlguard_ninja/core/rules/catalog.py +61 -0
sqlguard_ninja/core/rules/functions.py +197 -0
sqlguard_ninja/core/rules/statements.py +99 -0
sqlguard_ninja/core/rules/structure.py +72 -0
sqlguard_ninja/core/rules/tenant.py +196 -0
sqlguard_ninja/integrations/__init__.py +43 -0
sqlguard_ninja/integrations/audit.py +109 -0
sqlguard_ninja/integrations/checkpoint.py +342 -0
sqlguard_ninja/integrations/executors.py +64 -0
sqlguard_ninja/integrations/fastapi.py +89 -0
sqlguard_ninja/integrations/langchain.py +67 -0
sqlguard_ninja/integrations/langgraph.py +87 -0
sqlguard_ninja/policy/__init__.py +39 -0
sqlguard_ninja/policy/model.py +370 -0
sqlguard_ninja/privacy/__init__.py +9 -0
sqlguard_ninja/privacy/rules.py +286 -0
sqlguard_ninja/privacy/suggest.py +46 -0
sqlguard_ninja/py.typed +0 -0
sqlguard_ninja/query_cost/__init__.py +1 -0
sqlguard_ninja/query_cost/postgres.py +226 -0
sqlguard_ninja/query_cost/static.py +241 -0
sqlguard_ninja/reporting/__init__.py +1 -0
sqlguard_ninja/reporting/markdown.py +137 -0
sqlguard_ninja-0.1.0.dist-info/METADATA +370 -0
sqlguard_ninja-0.1.0.dist-info/RECORD +68 -0
sqlguard_ninja-0.1.0.dist-info/WHEEL +4 -0
sqlguard_ninja-0.1.0.dist-info/entry_points.txt +2 -0
sqlguard_ninja-0.1.0.dist-info/licenses/LICENSE +202 -0
sqlguard_ninja-0.1.0.dist-info/licenses/THIRD_PARTY_NOTICES.md +56 -0

sqlguard_ninja/_data/benchmarks/datasets/v1/generated/tenant_matrix.yaml ADDED Viewed

@@ -0,0 +1,684 @@
+# GENERATED by scripts/generate_corpus.py (seed 20261024). Do not edit by hand.
+cases:
+- id: GEN-TENANT-customers-missing
+  role: support_analyst
+  sql: SELECT t.id FROM customers t LIMIT 50
+  dialects: &id001
+  - postgres
+  - sqlite
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'missing' on customers.
+- id: GEN-TENANT-customers-wrong
+  role: support_analyst
+  sql: SELECT t.id FROM customers t WHERE t.tenant_id = 3 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'wrong' on customers.
+- id: GEN-TENANT-customers-or_bypass
+  role: support_analyst
+  sql: SELECT t.id FROM customers t WHERE t.tenant_id = 1 OR t.id > 0 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'or_bypass' on customers.
+- id: GEN-TENANT-customers-in_multi
+  role: support_analyst
+  sql: SELECT t.id FROM customers t WHERE t.tenant_id IN (1, 3) LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'in_multi' on customers.
+- id: GEN-TENANT-customers-range
+  role: support_analyst
+  sql: SELECT t.id FROM customers t WHERE t.tenant_id > 0 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'range' on customers.
+- id: GEN-TENANT-customers-pinned
+  role: support_analyst
+  sql: SELECT t.id FROM customers t WHERE t.tenant_id = 1 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'pinned' on customers.
+- id: GEN-TENANT-customers-pinned_reversed
+  role: support_analyst
+  sql: SELECT t.id FROM customers t WHERE 1 = t.tenant_id LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'pinned_reversed' on customers.
+- id: GEN-TENANT-customers-pinned_param
+  role: support_analyst
+  sql: SELECT t.id FROM customers t WHERE t.tenant_id = :tenant_id LIMIT 50
+  dialects: &id002
+  - postgres
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'pinned_param' on customers.
+- id: GEN-TENANT-customers-outer_unpinned
+  role: support_analyst
+  sql: SELECT t.id FROM customers t WHERE t.id IN (SELECT x.id FROM customers x WHERE x.tenant_id = 1) LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'outer_unpinned' on customers.
+- id: GEN-TENANT-customers-both_pinned
+  role: support_analyst
+  sql: SELECT t.id FROM customers t WHERE t.tenant_id = 1 AND t.id IN (SELECT x.id FROM customers x WHERE x.tenant_id = 1)
+    LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'both_pinned' on customers.
+- id: GEN-TENANT-orders-missing
+  role: support_analyst
+  sql: SELECT t.id FROM orders t LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'missing' on orders.
+- id: GEN-TENANT-orders-wrong
+  role: support_analyst
+  sql: SELECT t.id FROM orders t WHERE t.tenant_id = 3 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'wrong' on orders.
+- id: GEN-TENANT-orders-or_bypass
+  role: support_analyst
+  sql: SELECT t.id FROM orders t WHERE t.tenant_id = 1 OR t.id > 0 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'or_bypass' on orders.
+- id: GEN-TENANT-orders-in_multi
+  role: support_analyst
+  sql: SELECT t.id FROM orders t WHERE t.tenant_id IN (1, 3) LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'in_multi' on orders.
+- id: GEN-TENANT-orders-range
+  role: support_analyst
+  sql: SELECT t.id FROM orders t WHERE t.tenant_id > 0 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'range' on orders.
+- id: GEN-TENANT-orders-pinned
+  role: support_analyst
+  sql: SELECT t.id FROM orders t WHERE t.tenant_id = 1 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'pinned' on orders.
+- id: GEN-TENANT-orders-pinned_reversed
+  role: support_analyst
+  sql: SELECT t.id FROM orders t WHERE 1 = t.tenant_id LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'pinned_reversed' on orders.
+- id: GEN-TENANT-orders-pinned_param
+  role: support_analyst
+  sql: SELECT t.id FROM orders t WHERE t.tenant_id = :tenant_id LIMIT 50
+  dialects: *id002
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'pinned_param' on orders.
+- id: GEN-TENANT-orders-outer_unpinned
+  role: support_analyst
+  sql: SELECT t.id FROM orders t WHERE t.id IN (SELECT x.id FROM orders x WHERE x.tenant_id = 1) LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'outer_unpinned' on orders.
+- id: GEN-TENANT-orders-both_pinned
+  role: support_analyst
+  sql: SELECT t.id FROM orders t WHERE t.tenant_id = 1 AND t.id IN (SELECT x.id FROM orders x WHERE x.tenant_id = 1) LIMIT
+    50
+  dialects: *id001
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'both_pinned' on orders.
+- id: GEN-TENANT-order_items-missing
+  role: support_analyst
+  sql: SELECT t.id FROM order_items t LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'missing' on order_items.
+- id: GEN-TENANT-order_items-wrong
+  role: support_analyst
+  sql: SELECT t.id FROM order_items t WHERE t.tenant_id = 3 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'wrong' on order_items.
+- id: GEN-TENANT-order_items-or_bypass
+  role: support_analyst
+  sql: SELECT t.id FROM order_items t WHERE t.tenant_id = 1 OR t.id > 0 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'or_bypass' on order_items.
+- id: GEN-TENANT-order_items-in_multi
+  role: support_analyst
+  sql: SELECT t.id FROM order_items t WHERE t.tenant_id IN (1, 3) LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'in_multi' on order_items.
+- id: GEN-TENANT-order_items-range
+  role: support_analyst
+  sql: SELECT t.id FROM order_items t WHERE t.tenant_id > 0 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'range' on order_items.
+- id: GEN-TENANT-order_items-pinned
+  role: support_analyst
+  sql: SELECT t.id FROM order_items t WHERE t.tenant_id = 1 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'pinned' on order_items.
+- id: GEN-TENANT-order_items-pinned_reversed
+  role: support_analyst
+  sql: SELECT t.id FROM order_items t WHERE 1 = t.tenant_id LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'pinned_reversed' on order_items.
+- id: GEN-TENANT-order_items-pinned_param
+  role: support_analyst
+  sql: SELECT t.id FROM order_items t WHERE t.tenant_id = :tenant_id LIMIT 50
+  dialects: *id002
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'pinned_param' on order_items.
+- id: GEN-TENANT-order_items-outer_unpinned
+  role: support_analyst
+  sql: SELECT t.id FROM order_items t WHERE t.id IN (SELECT x.id FROM order_items x WHERE x.tenant_id = 1) LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'outer_unpinned' on order_items.
+- id: GEN-TENANT-order_items-both_pinned
+  role: support_analyst
+  sql: SELECT t.id FROM order_items t WHERE t.tenant_id = 1 AND t.id IN (SELECT x.id FROM order_items x WHERE x.tenant_id
+    = 1) LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'both_pinned' on order_items.
+- id: GEN-TENANT-products-missing
+  role: support_analyst
+  sql: SELECT t.id FROM products t LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'missing' on products.
+- id: GEN-TENANT-products-wrong
+  role: support_analyst
+  sql: SELECT t.id FROM products t WHERE t.tenant_id = 3 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'wrong' on products.
+- id: GEN-TENANT-products-or_bypass
+  role: support_analyst
+  sql: SELECT t.id FROM products t WHERE t.tenant_id = 1 OR t.id > 0 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'or_bypass' on products.
+- id: GEN-TENANT-products-in_multi
+  role: support_analyst
+  sql: SELECT t.id FROM products t WHERE t.tenant_id IN (1, 3) LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'in_multi' on products.
+- id: GEN-TENANT-products-range
+  role: support_analyst
+  sql: SELECT t.id FROM products t WHERE t.tenant_id > 0 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'range' on products.
+- id: GEN-TENANT-products-pinned
+  role: support_analyst
+  sql: SELECT t.id FROM products t WHERE t.tenant_id = 1 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'pinned' on products.
+- id: GEN-TENANT-products-pinned_reversed
+  role: support_analyst
+  sql: SELECT t.id FROM products t WHERE 1 = t.tenant_id LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'pinned_reversed' on products.
+- id: GEN-TENANT-products-pinned_param
+  role: support_analyst
+  sql: SELECT t.id FROM products t WHERE t.tenant_id = :tenant_id LIMIT 50
+  dialects: *id002
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'pinned_param' on products.
+- id: GEN-TENANT-products-outer_unpinned
+  role: support_analyst
+  sql: SELECT t.id FROM products t WHERE t.id IN (SELECT x.id FROM products x WHERE x.tenant_id = 1) LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'outer_unpinned' on products.
+- id: GEN-TENANT-products-both_pinned
+  role: support_analyst
+  sql: SELECT t.id FROM products t WHERE t.tenant_id = 1 AND t.id IN (SELECT x.id FROM products x WHERE x.tenant_id = 1) LIMIT
+    50
+  dialects: *id001
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'both_pinned' on products.
+- id: GEN-TENANT-payments-missing
+  role: support_analyst
+  sql: SELECT t.id FROM payments t LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'missing' on payments.
+- id: GEN-TENANT-payments-wrong
+  role: support_analyst
+  sql: SELECT t.id FROM payments t WHERE t.tenant_id = 3 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'wrong' on payments.
+- id: GEN-TENANT-payments-or_bypass
+  role: support_analyst
+  sql: SELECT t.id FROM payments t WHERE t.tenant_id = 1 OR t.id > 0 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'or_bypass' on payments.
+- id: GEN-TENANT-payments-in_multi
+  role: support_analyst
+  sql: SELECT t.id FROM payments t WHERE t.tenant_id IN (1, 3) LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'in_multi' on payments.
+- id: GEN-TENANT-payments-range
+  role: support_analyst
+  sql: SELECT t.id FROM payments t WHERE t.tenant_id > 0 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'range' on payments.
+- id: GEN-TENANT-payments-pinned
+  role: support_analyst
+  sql: SELECT t.id FROM payments t WHERE t.tenant_id = 1 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'pinned' on payments.
+- id: GEN-TENANT-payments-pinned_reversed
+  role: support_analyst
+  sql: SELECT t.id FROM payments t WHERE 1 = t.tenant_id LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'pinned_reversed' on payments.
+- id: GEN-TENANT-payments-pinned_param
+  role: support_analyst
+  sql: SELECT t.id FROM payments t WHERE t.tenant_id = :tenant_id LIMIT 50
+  dialects: *id002
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'pinned_param' on payments.
+- id: GEN-TENANT-payments-outer_unpinned
+  role: support_analyst
+  sql: SELECT t.id FROM payments t WHERE t.id IN (SELECT x.id FROM payments x WHERE x.tenant_id = 1) LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'outer_unpinned' on payments.
+- id: GEN-TENANT-payments-both_pinned
+  role: support_analyst
+  sql: SELECT t.id FROM payments t WHERE t.tenant_id = 1 AND t.id IN (SELECT x.id FROM payments x WHERE x.tenant_id = 1) LIMIT
+    50
+  dialects: *id001
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'both_pinned' on payments.
+- id: GEN-TENANT-shipments-missing
+  role: support_analyst
+  sql: SELECT t.id FROM shipments t LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'missing' on shipments.
+- id: GEN-TENANT-shipments-wrong
+  role: support_analyst
+  sql: SELECT t.id FROM shipments t WHERE t.tenant_id = 3 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'wrong' on shipments.
+- id: GEN-TENANT-shipments-or_bypass
+  role: support_analyst
+  sql: SELECT t.id FROM shipments t WHERE t.tenant_id = 1 OR t.id > 0 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'or_bypass' on shipments.
+- id: GEN-TENANT-shipments-in_multi
+  role: support_analyst
+  sql: SELECT t.id FROM shipments t WHERE t.tenant_id IN (1, 3) LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'in_multi' on shipments.
+- id: GEN-TENANT-shipments-range
+  role: support_analyst
+  sql: SELECT t.id FROM shipments t WHERE t.tenant_id > 0 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'range' on shipments.
+- id: GEN-TENANT-shipments-pinned
+  role: support_analyst
+  sql: SELECT t.id FROM shipments t WHERE t.tenant_id = 1 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'pinned' on shipments.
+- id: GEN-TENANT-shipments-pinned_reversed
+  role: support_analyst
+  sql: SELECT t.id FROM shipments t WHERE 1 = t.tenant_id LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'pinned_reversed' on shipments.
+- id: GEN-TENANT-shipments-pinned_param
+  role: support_analyst
+  sql: SELECT t.id FROM shipments t WHERE t.tenant_id = :tenant_id LIMIT 50
+  dialects: *id002
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'pinned_param' on shipments.
+- id: GEN-TENANT-shipments-outer_unpinned
+  role: support_analyst
+  sql: SELECT t.id FROM shipments t WHERE t.id IN (SELECT x.id FROM shipments x WHERE x.tenant_id = 1) LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'outer_unpinned' on shipments.
+- id: GEN-TENANT-shipments-both_pinned
+  role: support_analyst
+  sql: SELECT t.id FROM shipments t WHERE t.tenant_id = 1 AND t.id IN (SELECT x.id FROM shipments x WHERE x.tenant_id = 1)
+    LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'both_pinned' on shipments.
+- id: GEN-TENANT-support_tickets-missing
+  role: support_analyst
+  sql: SELECT t.id FROM support_tickets t LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'missing' on support_tickets.
+- id: GEN-TENANT-support_tickets-wrong
+  role: support_analyst
+  sql: SELECT t.id FROM support_tickets t WHERE t.tenant_id = 3 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'wrong' on support_tickets.
+- id: GEN-TENANT-support_tickets-or_bypass
+  role: support_analyst
+  sql: SELECT t.id FROM support_tickets t WHERE t.tenant_id = 1 OR t.id > 0 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'or_bypass' on support_tickets.
+- id: GEN-TENANT-support_tickets-in_multi
+  role: support_analyst
+  sql: SELECT t.id FROM support_tickets t WHERE t.tenant_id IN (1, 3) LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'in_multi' on support_tickets.
+- id: GEN-TENANT-support_tickets-range
+  role: support_analyst
+  sql: SELECT t.id FROM support_tickets t WHERE t.tenant_id > 0 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'range' on support_tickets.
+- id: GEN-TENANT-support_tickets-pinned
+  role: support_analyst
+  sql: SELECT t.id FROM support_tickets t WHERE t.tenant_id = 1 LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'pinned' on support_tickets.
+- id: GEN-TENANT-support_tickets-pinned_reversed
+  role: support_analyst
+  sql: SELECT t.id FROM support_tickets t WHERE 1 = t.tenant_id LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'pinned_reversed' on support_tickets.
+- id: GEN-TENANT-support_tickets-pinned_param
+  role: support_analyst
+  sql: SELECT t.id FROM support_tickets t WHERE t.tenant_id = :tenant_id LIMIT 50
+  dialects: *id002
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'pinned_param' on support_tickets.
+- id: GEN-TENANT-support_tickets-outer_unpinned
+  role: support_analyst
+  sql: SELECT t.id FROM support_tickets t WHERE t.id IN (SELECT x.id FROM support_tickets x WHERE x.tenant_id = 1) LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: deny
+  reason: tenant_isolation
+  classification: policy_violation
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'outer_unpinned' on support_tickets.
+- id: GEN-TENANT-support_tickets-both_pinned
+  role: support_analyst
+  sql: SELECT t.id FROM support_tickets t WHERE t.tenant_id = 1 AND t.id IN (SELECT x.id FROM support_tickets x WHERE x.tenant_id
+    = 1) LIMIT 50
+  dialects: *id001
+  category: tenant_isolation
+  expected: allow
+  reason: none
+  provenance: generated:tenant_matrix@20261024
+  explanation: Tenant pattern 'both_pinned' on support_tickets.