Connection grants

Connection grants

A grant says “principal X can query connection Y, scoped to tables Z, under optional row-level predicates.”

Principals can be:

• A specific user (their UUID).
• A role (member, admin, etc.).
• A workspace (everyone in that workspace).

Create a grant

From a connection row → Grants tab → Add grant.

1. Pick the principal (user / role / workspace).
2. Set the table allowlist — what they’re allowed to query. Use globs: demo.* allows every table in the demo schema; analytics.fact_* allows all tables whose names start with fact_.
3. (Optional) Add a scope predicate — a SQL expression injected into every query. Example for tenant isolation:

   tenant_id = :user.tenant_id

   Pollenix substitutes :user.tenant_id at query time from the requesting user’s identity.
4. Save.

Grant editor — principal, allowlist globs, scope predicate.

Allowlist syntax

Pattern	Matches
public.users	Exactly that table.
demo.*	Every table in the demo schema.
*fact*	Every table whose name contains fact.
analytics.dim_?ate	dim_date, dim_rate — single-char wildcard.

Patterns are evaluated case-insensitively.

Scope predicates

Scope predicates are conjunctive — they’re ANDed into every query the NL→SQL writer generates. Use them for row-level isolation:

-- Per-region carve-out
region = 'NA'

-- Per-tenant
tenant_id = :user.tenant_id

-- Per-account (multi-tenant SaaS upstream)
account_id IN (SELECT account_id FROM user_accounts WHERE user_id = :user.id)

Predicates are validated against the schema catalog when saved — a typo on a column name fails fast instead of erroring at query time.

Resolution order

When a user asks a question:

1. Pollenix collects every grant matching their user / role / workspace.
2. The allowlist is the union of all matching grants.
3. The scope predicate is the union of all predicates (AND’d together at runtime).

So a user in two workspaces sees the union of both workspaces’ tables, subject to both predicates.

Audit

Every grant change emits an audit event (connection.grant_create, connection.grant_delete, etc.). See Audit.