Query policies

A policy is a named, reusable set of query-firewall rules that you activate on connections. Policies are identity-agnostic: their scope is the connection they're activated on.

Rule actions

Each rule produces a verdict:

• Deny — block the query. This is the default action (a safe default).
• Approve — hold the query until someone approves it; the exact statement then runs once. See Query approvals.
• Alert — allow the query but record it for audit.
• Allow — explicitly permit the query.

When several rules match, the strongest action wins: deny > approve > alert > allow.

What a rule matches

• Operations — e.g. select, insert, update, delete, truncate, drop_table, drop_database, alter, create, grant/revoke (Postgres), copy, and more. The vocabulary is engine-neutral; a rule naming an operation the connection's engine never emits is simply inert.
• Targets — table/schema globs (e.g. billing.*, public.users).
• Guards — require a WHERE filter, or require a LIMIT.

A rule must do something — at least one operation, or a filter/limit guard.

Fail mode

Set on the connection, the fail mode decides what happens to unparseable queries:

• Deny (fail closed) — the secure default.
• Allow (fail open).

Activating a policy

Create the policy, then activate it on a connection from that connection's edit screen. Deleting a policy stops its enforcement on every connection using it.

Risk scoring

To label every statement as low, medium or high risk and act on the level, see Query risk scoring.