Row-level security for AI analytics
5 min readUpdated
Row-level security restricts which rows a given identity may see, evaluated when the query runs rather than when a result is displayed. It becomes critical in AI analytics because a natural-language system composes its own queries and an agent never loads the interface where display-time filtering happens, so any rule not enforced in the data path is effectively optional.
Display-time filtering is not security
If a platform filters rows as it renders a table, the filter is a presentation choice. Anything that reaches the data by another route. An export, an API call, an agent over MCP, reaches unfiltered data.
The test is simple to state: if the same identity asks the same question through a different surface, does the same restriction apply? If the answer depends on which surface, the restriction is not row-level security.
What to ask a vendor
- Where is the predicate applied?In the database, as part of the executed query, or in application code after the rows come back? Only the first survives a path the vendor did not anticipate.
- What happens if the attribute is missing?If a user's region attribute fails to resolve, does the query return everything or nothing? Failing open is the common and dangerous default.
- Does it hold across sources?A question that spans two systems has to carry the restriction into both legs, or the join leaks what the individual queries would not.
- Is the caller's identity carried to the source?For business applications with their own permission models, per-user authorization means the source's own rules apply too, rather than a shared integration account flattening them.
How Nexatron handles it
Nexatron enforces tenant isolation and row-level rules in the database, on the executed query, with the tenant context set per request, so the same restriction applies whether the question arrives from the product, an export, the SDK, or an agent over MCP.
For connected business applications that maintain their own permissions, connections can be authorized per user, so what the platform can read is bounded by what the signed-in person could read in the source system.