The latest articles on DEV Community by Yogendra Sharma (@yogendra_colrows). https://dev.to/yogendra_colrows https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F3981553%2F1484002c-3a6b-4a54-806c-b538d687c2a9.png https://dev.to/yogendra_colrows en Yogendra Sharma Tue, 04 Aug 2026 14:59:57 +0000 https://dev.to/yogendra_colrows/fine-grained-data-access-control-precision-security-595g https://dev.to/yogendra_colrows/fine-grained-data-access-control-precision-security-595g <p>Most enterprises secure the dashboard and leave the query wide open.</p> <p>By the time your access filter fires, the data has already left the warehouse.</p> <h2> Why tool-level controls don't travel </h2> <p>Row and column rules bolted onto a BI tool protect exactly one surface. The moment an AI agent reaches the same warehouse through a different door — an MCP server, a notebook, a REST call — those rules don't come with it.</p> <p>So teams do what's available: duplicate datasets per audience, maintain parallel views, and accept that the copies drift.</p> <h2> Attach policy to meaning, not storage </h2> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th></th> <th>Tool-level ACLs</th> <th>Compile-time predicates</th> </tr> </thead> <tbody> <tr> <td>Attached to</td> <td>Reports, folders, views</td> <td>Entities, metrics, relationships</td> </tr> <tr> <td>Travels to new consumers</td> <td>No — re-implement per tool</td> <td>Yes — it's part of the concept</td> </tr> <tr> <td>Unauthorised request</td> <td>Filtered result</td> <td>Fails to compile</td> </tr> <tr> <td>Rows read</td> <td>Then hidden</td> <td>Never read</td> </tr> <tr> <td>Audit artefact</td> <td>Access log</td> <td>The SQL, with predicates inline</td> </tr> </tbody> </table></div> <p>The third row is the security boundary. "Filtered afterwards" means the query ran with full privileges and something downstream decided what you were allowed to see.</p> <h2> What precision looks like in practice </h2> <p>RBAC gets you role membership. ABAC adds attributes — region, cost centre, clearance, purpose of use. Row and column predicates then narrow the actual result at compile time, per person, per question.</p> <p>One governed query path serves every persona and returns a different, correct slice to each. No shadow copies to reconcile, and no separate governance implementation per tool.</p> <p>That's the difference between preventing a breach and documenting one.</p> <p><strong>The full breakdown</strong> — the policy model, how RBAC and ABAC compose, and the predicate injection mechanics — is here:</p> <p>👉 <strong><a href="https://colrows.com/blogs/fine-grained-data-access-control-precision-security/" rel="noopener noreferrer">Fine-Grained Data Access Control: Precision &amp; Security</a></strong></p> <p><em>Originally published at <a href="https://colrows.com/blogs/fine-grained-data-access-control-precision-security/" rel="noopener noreferrer">colrows.com/blogs/fine-grained-data-access-control-precision-security</a></em></p> ai security architecture dataengineering