AppsAutessaDB

Row-level security and access · AutessaDB

Security roles

AutessaDB security roles are reusable bundles of access rules. Each role holds table policies, a row rule, an edit check and column rules for each table it covers, and is assigned to people, teams, company roles, everyone at the company, custom apps or API keys.

Goes beyond a typical managed database
Role · Field operations2 table policiesSAMPLE

Table policies

work_orders · rows: assignee = $CURRENT_USER_EMAILsites · gate_code masked

Assignments

principal typewho
TEAMField technicians
COMPANY_ROLEManager
CUSTOM_APPTechnician Portal
API_KEYdispatch-sync key

-- the problem

Per-table permissions do not scale past a few tables

Setting rules on each table for each person turns into a maze. Roles let you write "Regional sales" once, cover every table it touches, and assign it to the team, the field app and the reporting key in one place.

What you get

  • A role's table policies each carry a row rule, an edit check and column exceptions.
  • Assign to USER, TEAM, COMPANY_ROLE, COMPANY, CUSTOM_APP or API_KEY principals.
  • CUSTOM_APP roles govern visitors of public and sign-in apps; apps in the default hosting mode act as the person using them instead.
  • API_KEY roles can be assigned only to keys you own, or administer and can fully reach.
  • You can create or change a role only if you are an admin of every table it touches.
  • Set a role as a table's default so everyone you share the table with gets it.

-- how it works

How does security roles work in AutessaDB?

  1. Name the role

    Create a role and describe what it restricts and for whom.

  2. Add table policies

    Add a policy per table: row filter, edit check and column rules.

  3. Assign

    Add people, teams, company roles, everyone, apps or API keys under Assignments.

-- every option

Assignment types

optionwhat it does
USEROne person.
TEAMEveryone on a team.
COMPANY_ROLEEveryone holding a company role, such as Manager.
COMPANYEveryone at the company.
CUSTOM_APPVisitors of a public or sign-in app.
API_KEYAn API key that uses its own role.

-- example

Manage roles from the CLIbash
autessa autessadb roles list
autessa autessadb roles get --roleId <roleId>
autessa autessadb roles create --json '{...}'
autessa autessadb roles update --json '{...}'

Full reference in the AutessaDB CLI docs and the API reference.

-- permissions

Who can do what?

accesscan
Admin of every covered tableCreate, change and delete the role.
Role memberThe union of rows and columns all their roles allow.

-- relations

How it connects

autessadb feature

Row-level security

Row rules and edit checks.

autessadb feature

Column masking

Column rules inside each policy.

autessadb feature

App backend

Roles for app visitors.

-- faq

Questions about security roles

Who can a security role apply to?

People, teams, company roles, everyone at the company, custom apps (for their visitors) and API keys that use their own role.

Who can edit a role?

Only someone who is an admin of every table the role touches.

Which roles apply in internal apps?

The roles of the person using the app. Apps in the default hosting mode act as the person using them, so that person's roles apply.

$ autessa autessadb tables create

Try security roles in AutessaDB

A role bundles table policies (row rule, edit check, column rules) and is assigned to people, teams, company roles, everyone, custom apps or API keys.

Read the AutessaDB guide or install the CLI.

100% customizable, code and all

Make AutessaDB fully your own.

Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.

Start free and make it yours