Policy schema¶

A policy object is a YAML document with these fields.

Field	Type	Required	Meaning
`apiVersion`	string	yes	`sluice.bino.bi/v1alpha1`, `sluice.bino.bi/v1beta1`. See Kinds.
`kind`	string	yes	See Kinds.
`metadata.name`	string	yes	Lower-case letters, digits and `-`. Starts and ends with a letter or digit. Unique per kind.
`metadata.labels`	map		Free keys and values. Sluice ignores them.
`metadata.annotations`	map		Free keys and values. Sluice ignores them.
`metadata.priority`	int		0 to 1000. Higher comes first.
`spec`	object	yes	The fields of the kind.

Kinds¶

Kind	`apiVersion`	Page
`SqlAccessPolicy`	`sluice.bino.bi/v1alpha1`	Access control
`RowFilterPolicy`	`sluice.bino.bi/v1alpha1`	Row filters
`ColumnMaskPolicy`	`sluice.bino.bi/v1alpha1`	Column masks
`QueryRejectPolicy`	`sluice.bino.bi/v1alpha1`	Rejects and rewrites
`QueryRewritePolicy`	`sluice.bino.bi/v1alpha1`	Rejects and rewrites
`ApprovalPolicy`	`sluice.bino.bi/v1alpha1`	Approvals
`DataSource`	`sluice.bino.bi/v1alpha1`	Data sources
`SubjectBinding`	`sluice.bino.bi/v1alpha1`	Subjects
`DataClassification`	`sluice.bino.bi/v1beta1`	Classification
`RelationshipPolicy`	`sluice.bino.bi/v1beta1`	ReBAC

Shared fields¶

These kinds have the fields below: SqlAccessPolicy, RowFilterPolicy, ColumnMaskPolicy, QueryRejectPolicy, QueryRewritePolicy, ApprovalPolicy, RelationshipPolicy.

Field	Type	Required	Meaning
`enforcementMode`	string		`Enforce`, `Audit`, `DryRun`. Default `Enforce`. The others do not apply the policy.
`match`	Selector	yes	What the policy covers. Needs `any` or `all`.
`exclude`	Selector		What the policy leaves out.
`conditions`	Condition list		All must be true. Not in `RelationshipPolicy`.

Types¶

Selector¶

Field	Type	Required	Meaning
`any`	Clause list		One clause must match.
`all`	Clause list		Every clause must match.

Clause¶

Field	Type	Required	Meaning
`subjects.jwtClaims[].claim`	string	yes	Claim path. Dots separate the parts.
`subjects.jwtClaims[].op`	string	yes	`Equals`, `NotEquals`, `In`, `NotIn`, `Exists`, `Matches`.
`subjects.jwtClaims[].value`	any		For `Equals`, `NotEquals`.
`subjects.jwtClaims[].values`	[]any		For `In`, `NotIn`.
`subjects.jwtClaims[].pattern`	string		Regular expression for `Matches`.
`subjects.groups`	[]string		Group names. One is enough.
`subjects.apiKeys`	[]string		Subject ids of API key subjects.
`subjects.ipRanges`	[]string		CIDR ranges. The address of the client must be in one.
`subjects.roles`	[]string		Values of the `roles` claim. Without the claim, Sluice uses the groups.
`resources`	ResourceSelector		Tables to match.

ResourceSelector¶

Field	Type	Meaning
`catalogs`	[]string	Catalog names. `*` is a wildcard.
`schemas`	[]string	Schema names.
`tables`	[]string	Table names.
`columns`	[]string	Column names. A mask needs them.
`tags`	[]string	Tags of a `DataClassification`.
`actions`	[]string	`SELECT`, `INSERT`, `UPDATE`, `DELETE`.

Condition¶

Field	Type	Required	Meaning
`name`	string		Name of the check.
`expression`	string	yes	CEL. Must give true or false.

Predicate¶

Field	Type	Meaning
`all`	Predicate list	Every part must hold.
`any`	Predicate list	One part must hold.
`not`	Predicate	The part must not hold.
`column`	string	Column to test.
`op`	string	`Equals`, `NotEquals`, `In`, `NotIn`, `GreaterThan`, `GreaterThanOrEqual`, `LessThan`, `LessThanOrEqual`, `Between`, `Like`, `NotLike`, `IsNull`, `IsNotNull`, `Matches`, `StartsWith`, `EndsWith`, `Contains`.
`value`	any	Value to compare with.
`values`	[]any	For `In`, `NotIn`, `Between`.

SyntheticPrivacy¶

Field	Type	Meaning
`minGroupSize`	int	Smallest group of source rows a value, bin or bound may come from. 2 or more. Default 5.
`clipOutliers.lower`	float	Source quantile of the lower bound. 0 or more, below `upper`.
`clipOutliers.upper`	float	Source quantile of the upper bound. At most 1.
`extremeJitter`	object	Moves the lower and upper bound by a random share of the range. `off` turns it off.
`extremeJitter.min`	float	Smallest share. 0 or more.
`extremeJitter.max`	float	Largest share. At most 0.5.
`spikeWarning`	bool	Warn about a few rows far from the rest. Default true.
`strictTags`	[]string	Tags whose columns need a generator set by a column entry or a rule. Default `pii`. Only on the data source.
`rejectExactMatches`	[]string	Columns that together must not equal a source row. Only on a table.
`noise`	object	Adds Laplace noise to the profile counts. Only on the data source.
`noise.epsilon`	float	Privacy budget of one build of the whole data source. From 0.001 to 100. Smaller is more private and less exact.
`bounds`	object	Public range of a number, time or date column. Only on a column entry, with `noise`.
`bounds.min`	any	Lower end: a number (seconds of the day for `TIME`), or an ISO date or timestamp for `DATE` and `TIMESTAMP`. Same kind as `max`.
`bounds.max`	any	Upper end, above `min`.

SyntheticRule¶

Field	Type	Required	Meaning
`match.columns`	[]string		Column name patterns. `*` is a wildcard. Case does not matter.
`match.types`	[]string		Column type patterns, for example `DECIMAL*`. Case does not matter.
`match.tags`	[]string		Tags of a `DataClassification`.
`generator`	string	yes	Generator name, for example `distribution`, `categorical` or `randomString`. See Generators.
`args`	map		Arguments of the generator.

SqlAccessPolicy¶

Field	Type	Required	Meaning
`effect`	string	yes	`allow`, `deny`.
`message`	string		Message of a deny.
`errorCode`	string		Code of a deny. Default `ACL_DENIED`.

RowFilterPolicy¶

Field	Type	Required	Meaning
`filter.predicate`	Predicate	one of two	Filter as a tree.
`filter.expression`	string	one of two	Filter in CEL.
`combine`	string		`restrictive`, `permissive`. Default `restrictive`: all filters must hold.

ColumnMaskPolicy¶

Field	Type	Required	Meaning
`mask.type`	string	yes	`null`, `constant`, `partial`, `hash`, `regex`, `truncate`, `jitter`, `fpe`, `fake`.
`mask.args.value`	any		`constant`: the new value.
`mask.args.showFirst`	int		`partial`: characters kept at the start.
`mask.args.showLast`	int		`partial`: characters kept at the end.
`mask.args.maskChar`	string		`partial`: replacement character. Default `*`.
`mask.args.algorithm`	string		`hash`: `sha256`, `hmac_sha256`. Default `sha256`.
`mask.args.saltRef`	string		`hash`: secret reference to the salt.
`mask.args.pattern`	string		`regex`: pattern to replace.
`mask.args.replacement`	string		`regex`: new text.
`mask.args.length`	int		`truncate`: characters kept.
`mask.args.suffix`	string		`truncate`: text added at the end.
`mask.args.range`	float		`jitter`: largest change. Above 0, below 1.
`mask.args.seed`	string		`jitter`, `fake`: seed. Plain text or a secret reference.
`mask.args.keyRef`	string		`fpe`: secret reference to the key.
`mask.args.tweak`	string		`fpe`: tweak in hex.
`mask.args.alphabet`	string		`fpe`: `numeric` (default), `lower` or `alphanumeric`.
`mask.args.customAlphabet`	string		`fpe`: own alphabet.
`mask.args.fakeType`	string		`fake`: `name`, `first_name`, `last_name`, `email`, `phone`, `company`, `city`, `country` or `uuid`.

QueryRejectPolicy¶

Field	Type	Required	Meaning
`reject.rules`	list	yes	At least one rule.
`reject.rules[].name`	string		Rule name.
`reject.rules[].expression`	string		CEL. Empty means always reject.
`reject.rules[].message`	string		Message for the client.
`reject.rules[].code`	string		Error code. Default `ACL_REJECTED`.

QueryRewritePolicy¶

Field	Type	Required	Meaning
`rewrite`	object	yes	At least one of the fields below.
`rewrite.limit.max`	int		Maximum rows. 1 to 2147483647.
`rewrite.sample.rate`	float		Share of rows. Above 0, at most 1.
`rewrite.sample.method`	string		`reservoir`, `bernoulli`, `system`. Default `reservoir`.
`rewrite.timeout`	duration		Query timeout.

ApprovalPolicy¶

Field	Type	Required	Meaning
`when.columnsAccessed`	[]string		Column patterns. Use of one needs approval.
`when.predicates[].column`	string	yes	Column pattern in a comparison.
`when.predicates[].op`	string		`=`, `!=`, `<`, `<=`, `>`, `>=`, `like`, `ilike`, `in` or `isnull`. Empty means any.
`when.predicates[].value`	string		Compared value. Empty means any.
`reason`	string		Text for the approver.

DataSource¶

Field	Type	Required	Meaning
`type`	string	yes	`postgres`, `mysql`, `sqlite`, `s3`, `http`, `duckdb_file`, `motherduck`, `synthetic`.
`connection`	string	for `postgres`, `mysql`	Connection URL.
`credentialsRef`	string		Secret reference. `postgres`, `mysql`: the password. `s3`: the access key as JSON.
`path`	string	for `sqlite`, `duckdb_file`	Database file.
`bucket`	string	for `s3`	Bucket name.
`region`	string	for `s3`	Region.
`allowedPaths`	[]string		`s3`: files to read. One view per file.
`endpoint`	string		`s3`: host of an S3-compatible store.
`urls`	[]string	for `http`	File URLs. One view per file.
`headersRef`	string		`http`: secret reference to a JSON object of headers.
`format`	string		`s3`, `http`: `parquet`, `csv`, `json`, `xlsx`. Default: the file extension.
`database`	string	for `motherduck`	Database name.
`tokenRef`	string	for `motherduck`	Secret reference to the token.
`synthetic`	object	for `synthetic`	Builds a snapshot of generated rows from the profile of another data source. The name has only lower-case letters and digits. See Synthetic data.
`synthetic.source`	string	yes	Name of the data source to profile. Not a `synthetic` one.
`synthetic.seed`	string	yes	Secret reference to the seed. At least 16 bytes. The same seed and data give the same rows.
`synthetic.build.onStart`	string		`never`, `ifMissing`. Default `never`. `ifMissing` builds at server start when no snapshot exists.
`synthetic.privacy`	SyntheticPrivacy		Privacy settings for all tables.
`synthetic.rules`	SyntheticRule list		Generator rules for all tables. A table rule comes first.
`synthetic.tables`	list	yes	At least one table.
`synthetic.tables[].name`	string	yes	Source table as `schema.table`.
`synthetic.tables[].size.ratio`	float	one of two	Share of the source rows. Above 0, at most 1. A build over `synthetic.maxRatio` of the server config fails.
`synthetic.tables[].size.rows`	int	one of two	Fixed row count. 0 copies only the columns.
`synthetic.tables[].privacy`	SyntheticPrivacy		Privacy settings for this table. Not `strictTags` or `noise`. `bounds` only on a column entry.
`synthetic.tables[].profile.sampleRows`	int		Profile a sample of this many rows when the table has more. 1000 to 100 000 000. Without it the build reads the full table. See Profile on a sample.
`synthetic.tables[].columns`	map		Generator per column name. Each entry has `generator`, `args` and `privacy`, as in a rule. `privacy` has no `strictTags` or `noise`. See Generators.
`synthetic.tables[].rules`	SyntheticRule list		Generator rules for this table. A column entry comes first.

SubjectBinding¶

Field	Type	Required	Meaning
`issuer`	string		Issuer (`iss`) of the JWTs.
`audience`	string		Expected audience (`aud`).
`jwksUrl`	string		URL of the signing keys. Needs `issuer` and `audience`.
`hmacSecretRef`	string		Secret reference to the HMAC key.
`jwksCacheTtl`	duration		Cache time of the signing keys. Default `10m`.
`clockSkew`	duration		Allowed clock difference. Default `60s`.
`claims.subjectId`	string		JWT: claim path, default `sub`. API key: the subject id.
`claims.email`	string		JWT: claim path. API key: the email.
`claims.groups`	string		JWT: claim path. API key: one group.
`claims.tenantId`	string		JWT: path to the value. API key: the value. Policies read it as the `tenantId` claim.
`claims.allowedRegions`	string		JWT: path to the value. API key: the value. Policies read it as the `allowedRegions` claim.
`rateLimit.rps`	float		Requests per second for each subject.
`rateLimit.burst`	int		Burst. Default 1.
`budget.cpuSecondsPerDay`	int		Query seconds per subject and UTC day.
`budget.rowsPerDay`	int		Rows per subject and UTC day.
`apiKeys[].id`	string	yes	Key id.
`apiKeys[].hashRef`	string	yes	Secret reference to the key hash.
`apiKeys[].groups`	[]string		Groups of the subject.

DataClassification¶

Field	Type	Required	Meaning
`rules`	list	yes	At least one rule.
`rules[].resources`	ResourceSelector		Tables and columns. No `tags`, no `actions`. Without it, the rule tags every table.
`rules[].tags`	[]string	yes	Tags to set. Lower-case letters, digits, `.`, `_`, `-`.

RelationshipPolicy¶

Field	Type	Required	Meaning
`backend.endpoint`	string	yes	URL of the OpenFGA API.
`backend.storeId`	string	yes	OpenFGA store id.
`backend.authorizationModelId`	string		OpenFGA model id.
`backend.tokenRef`	string		Secret reference to the bearer token.
`backend.timeout`	duration		Timeout of a check. Default `3s`.
`checks`	list	yes	At least one check.
`checks[].objectTemplate`	string	yes	Object to check, for example `table:{{table}}`.
`checks[].relation`	string	yes	Relation the subject needs.
`checks[].subjectTemplate`	string		Default `user:{{subject.id}}`.