Cookbook¶
Each recipe is a complete setup under examples/ that you can run.
| Recipe | What it shows | Policy kinds |
|---|---|---|
| Multi-tenant isolation | One row filter separates two tenants. | RowFilterPolicy |
| PII masking | Three columns come back masked. | ColumnMaskPolicy |
| Break-glass access | One group sees the real values. | ColumnMaskPolicy |
| Approval workflow | A person must accept a query. | ApprovalPolicy |
| Cross-source joins | One query joins two data sources. | ColumnMaskPolicy, QueryRejectPolicy |
| MCP agents | An agent queries under a row limit. | QueryRewritePolicy |
Every recipe also has a SqlAccessPolicy. Without an allow, Sluice denies every query.
Run an example¶
- Build
sluiceand put it on yourPATH. See the Quickstart. - Start the server with
examples/<name>/serve.sh. - From the example folder, run the files in
steps/in order.
expected/ holds the real output of each step. The recipes show it indented, with placeholders such as <query-id> for values that change. Duration fields are left out.