Row-level isolation
The Nebbos platform enforces data isolation at the database layer through native row-security policies. Application code that omits identity filtering cannot compose a response that discloses a row outside the caller’s authorised scope; the query is refused at the storage layer prior to answer composition.
Specification
Every operator-scoped substrate table carries an owning-scope column. Every query against these tables is rewritten by the substrate to include a predicate against that column. The rewrite is executed under the query planner, not in application code or middleware.
A caller without a resolved identity receives no rows. A caller with a resolved identity receives exactly the rows within its authorised scopes.
Rationale
Application-layer isolation depends on each code path applying the isolation check correctly. Every additional endpoint, report, administrative surface, or ad-hoc query is an additional site where the check may be omitted. Auditing an application-layer-isolation system requires enumeration of every such site.
Database-layer isolation removes this dependency. New endpoints, reports, and administrative surfaces inherit the isolation policy without additional integration work. Auditing reduces to inspection of the single enforcement point.
Implementation
Every substrate table carries an operator_scope column. Every operator identity carries a resolved list of authorised scopes. The database rewrites every SELECT, UPDATE, DELETE, and INSERT statement to include a predicate against that list, using native row-security machinery rather than application middleware.
Cross-scope operations, such as platform-wide administrative actions, require an Architect-tier identity. The substrate lifts the isolation predicate on a per-operation basis; it does not disable the predicate for a session and does not implement an impersonation primitive.
Constraints
| Operation | Behaviour |
|---|---|
| An identity spanning several operator scopes (consultant, support engineer, compliance officer) | Permitted. The substrate resolves the scope list at authentication and enforces the predicate against it. |
| A query hint intended to disable the predicate | Refused. |
| Access to a scope via a view that omits the scope column | Refused. |
| A join constructed to read a row that a plain SELECT would refuse | Refused. |
The isolation predicate is applied to every query independently. Chaining queries or nesting sub-queries does not accumulate authorisation.
Refusal recording
Every refused query produces one entry in the audit chain, including operator, tool, input hash, refusing policy, and timestamp. Refusal patterns are visible to the operator’s compliance officer through standard audit-chain queries.