AppsAutessaDB

Data lake and analytics · AutessaDB

Security on every query

Every query on the AutessaDB data lake passes through the same security as the rest of AutessaDB. Sharing decides which tables a caller can query, row rules filter what each person's queries see, hidden columns cannot be selected, and masked columns return masked values, whether the query comes from a person, an agent, a script, an app or an API key.

Goes beyond a typical managed database
same query · viewer: finance_adminSAMPLE
regioncustomer_tax_idorders
west84-221903418
east61-004487111
same query · viewer: sales_westSAMPLE
row rule: region = westcustomer_tax_id: masked
regioncustomer_tax_idorders
west•••• 903418
Masked values still group, count and join. They are never shown.

-- the problem

Analytics copies usually leave permissions behind

Exporting data to a separate warehouse means rebuilding who-sees-what there, or giving everyone everything. In AutessaDB the data lake is the same database, so the rules you wrote once apply to every SQL query, and sensitive values can still be counted and grouped without being shown.

What you get

  • READ to describe, preview and query; WRITE to load; ADMIN for schema, semantic layer, sharing and delete.
  • A join needs READ on every table, and a table you cannot read behaves as if it does not exist.
  • Row rules filter query results per person, and hidden columns cannot be selected.
  • Masked columns are stored encrypted and still work for =, IN, GROUP BY, DISTINCT, COUNT(DISTINCT ...), MIN/MAX, ORDER BY and joins with other masked columns.
  • Masked values appear only to someone allowed to see them in every table the query read, and every reveal is recorded in the access log.
  • An API key never sees more than its owner, and agents see only what their identity may see.
  • Query jobs and results are private to whoever ran them and company Admins.
  • Downloads contain mask text unless you choose with values shown.

-- how it works

How does security on every query work in AutessaDB?

  1. Share

    Grant READ, WRITE or ADMIN to people, teams, roles or the company.

  2. Add a role

    Row rules and column rules apply to SQL exactly as they do to the grid.

  3. Mask

    Mark sensitive text columns Masked when you create them.

  4. Query

    Every query, from any caller, is filtered and masked for that caller.

-- every option

Masked columns in SQL

optionwhat it does
Works=, <>, IN, IS NULL, GROUP BY, DISTINCT, COUNT(DISTINCT ...), MIN/MAX, ORDER BY and joins with other masked columns.
SortingFollows an internal code rather than the alphabet.
Not availableLIKE, ranges and other functions on masked values.
Visible roleReveal values one at a time or with Show values; every reveal is logged.
Masked roleAlways sees the mask: fully redacted, last four characters, or a consistent code.
Hidden roleThe column is not there at all.

-- example

Count customers on a masked column, without revealing itsql
SELECT region, COUNT(DISTINCT customer_tax_id) AS customers
FROM order_lines
WHERE order_date >= DATE '2026-01-01'
GROUP BY region

Full reference in the AutessaDB CLI docs and the API reference.

-- permissions

Who can do what?

accesscan
Table owners and adminsAlways reveal masked values.
READQuery, seeing only the rows and columns their roles allow.
Company AdminsSee every query job and its result.

-- relations

How it connects

autessadb feature

Column masking

The same masks as on relational tables.

autessadb feature

Row-level security

Row rules that filter every query.

autessadb feature

Data access log

Where every reveal is recorded.

-- faq

Questions about security on every query

Does row-level security apply to SQL?

Yes. Hidden columns cannot be selected, masked columns return masked values, and row rules filter what each person's queries see.

Can I group or join on a masked column?

Yes. Masked columns support equality, GROUP BY, DISTINCT counts, MIN/MAX, ORDER BY and joins with other masked columns, without showing the values.

Can an API key or agent see more than its owner?

No. Every caller sees only what the person or key it acts as could see.

$ autessa autessadb tables create

Try security on every query in AutessaDB

Sharing, row rules, hidden columns and masked columns apply to every SQL query, and masked values still group, count and join without ever being shown.

Read the AutessaDB guide or install the CLI.

100% customizable, code and all

Make AutessaDB fully your own.

Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.

Start free and make it yours