Query Engine Security Overview

The Query Engine implements a multi-layered security model that enforces access control at the query level. Security features include row-level security (RLS) for fine-grained data access, dynamic data masking for sensitive columns, and comprehensive audit logging of all masking operations.

Security Layers

Authentication Flow

Every query request passes through the JWT authentication filter:

1. Extract the Bearer token from the Authorization header
2. Validate the token signature and expiration
3. Extract tenant ID, user ID, and roles from the token claims
4. Set the SecurityContext for downstream components

The SecurityUtils class provides static methods to access the current tenant and user context:

UUID tenantId = SecurityUtils.getCurrentTenantId();
UUID userId = SecurityUtils.getCurrentUserId();

Tenant Isolation

All queries are automatically scoped to the requesting tenant. The query engine:

1. Validates that the referenced catalogs and schemas belong to the tenant
2. Injects tenant-scoped predicates into queries
3. Prevents cross-tenant data access at the engine level

Section Pages