★ Centerpiece · The live governance proof

Entitlements & access simulator

Everything on the Platform surface is a slide until you can prove it. Switch the acting role and access purpose below - including the Partner Aurora Analyst lens. The row count, the masked columns, and the audit log all change because they are enforced by real Postgres Row Level Security on the anon role - not faked in application code. (In the data plane, Aurora's scope value is 'nova' - the role partner_analyst_nova and the policy predicate partner_scope = 'nova' refer to the same fictional partner.) The policy SQL is shown on the right, committed in this repo, and independently re-checked against every result set by an in-repo TypeScript mirror of the same policies.

Acting asbacked by real Postgres RLS · every access audited

Access purpose

Data product

Rows visible to this entitlement context

…of …

……

atlas.synthetic_transactions · sample (RLS-scoped, masked per role)querying…

No rows returned for this entitlement context.

Independent check · in-repo engine

A TypeScript re-implementation of the committed RLS SQL (src/lib/atlas/rls/engine.ts vs src/lib/atlas/sql/0002-0003) re-judges every row the database returns. If the live policies ever drifted from the repo, this check fails loudly.

checking…

Active RLS policies

txn_basePERMISSIVE

create policy txn_base on atlas.synthetic_transactions
  for select to anon using (true);

Baseline visibility. The restrictive policies below subtract from this.

txn_partner_scopeRESTRICTIVE

create policy txn_partner_scope on atlas.synthetic_transactions
  as restrictive for select to anon
  using (case current_setting('app.role', true)
           when 'partner_analyst_nova' then partner_scope = 'nova'
           else true end);

A Partner Nova analyst can only ever see rows where partner_scope = 'nova'. Every other role is unaffected by this policy.

txn_fraud_purposeRESTRICTIVE

create policy txn_fraud_purpose on atlas.synthetic_transactions
  as restrictive for select to anon
  using (is_fraud = false
         or (current_setting('app.purpose', true) = 'fraud_prevention'
             and current_setting('app.role', true)
                 in ('fraud_analyst','data_scientist','auditor','admin')));

Confirmed-fraud rows are hidden unless the access is under the Fraud Prevention purpose AND the role is fraud-capable. Purpose is a first-class access dimension.

Audit logevery access, logged

No audit rows yet.

Verify it yourself · nothing load-bearing lives off-repo

src/lib/atlas/sql/0002_atlas_rls.sql

The row policies. One PERMISSIVE base per protected table + RESTRICTIVE scope policies (Postgres ORs permissive, ANDs restrictive - that combination rule is the design).

src/lib/atlas/sql/0003_atlas_rpcs.sql

query_dataset / run_select are SECURITY INVOKER, so RLS applies to every read. Column masking lives in the projection. log_access is the only SECURITY DEFINER write path - anon has no INSERT on audit_log.

src/lib/atlas/sql/0001 · 0005 · 0006

Schema + the SELECT-only anon grant (the true backstop behind the NL-to-SQL text guards), the reproducible seed (setseed 0.4242, no clear PAN), and the aggregates-only DEFINER dashboard function.

src/lib/atlas/rls/engine.ts

Independent TS re-implementation of the policies + masking. Runs in this page against every live result; a drifted database fails the check visibly. Also powers the labelled offline replay.

Reproduce without this site: run the six migrations in order on any Postgres 15+ with an anon role, then set role anon; select atlas.query_dataset('partner_analyst_nova','partner_reporting','synthetic_transactions',5); - the row count, scoping, and masking shown above fall out of the SQL alone. See src/lib/atlas/sql/README.md.