Provisa / Governance
Six layers, compiled into the plan.
Governance is applied at query time, uniformly, on every language and every transport. Add a source, a column, or a relationship and every layer applies automatically — there is nothing to remember and nothing to re-apply per API.
The layers
0 — Introspection filtering
Schema browsers only ever see what the role is allowed to see. A hidden table is not a table the user can discover and then be denied; it is absent from the catalog they are handed.
1 — Public access
The anonymous surface is declared explicitly. Nothing becomes publicly readable as a side effect of registering it.
2 — Domain access
Roles reach only the domains registered to them. Domains are the coarse boundary the finer layers operate inside.
3 — Row-level security
Per-table, per-role WHERE injection, inherited recursively — a view
over a governed table carries the predicate of everything beneath it, and so does
a materialized view built on that view.
4 — Column visibility and masking
Columns are visible, hidden, or masked per role. Masking is regex, constant, or truncation, with an explicit role-based bypass where a privileged role genuinely needs the raw value.
5 — Predicate guard and approval
A pre-execution ABAC hook over webhook, gRPC, or unix socket. The plan is offered to your own decision service before it runs, which is where request-time context — a ticket number, a break-glass approval, a time window — enters the decision.
Relationships are governed too
A JOIN, or a graph traversal, is legal only if it matches a registered, approved relationship. Unapproved paths are rejected and logged.
That is what lets the query and graph explorers be genuinely open: people can roam the model freely, and AI agents can discover what connects to what, while every path stays inside the edges policy sanctioned. Each relationship carries a human- and agent-readable reason for why the traversal exists, so the model explains itself to whoever — or whatever — is reading it.
It's a per-role capability
The guardrail is a single flag on the role. Leave it on for analysts and agents who should stay on the rails; take the training wheels off for a trusted role and it writes unconstrained JOINs across the whole federated schema. Same governed path, same RLS and masking — just without the relationship guard.
Observability as data
Traces, metrics, and logs are collected via OpenTelemetry, compacted into
Iceberg, and registered as queryable tables. Join customers to
queries to see who ran what and how long it took — the audit trail
is a governed table like any other, not a log file you grep.