Policy-driven access control for databases.
dbauthz compiles one access policy into each database's native roles and grants. It shows you the plan, applies it, and records every change in a tamper-evident audit log.
Status: pre-alpha. Nothing here is ready for production use.
| Engines | Support |
|---|---|
| PostgreSQL | First provider, in progress |
| MySQL / MariaDB | Second provider, planned |
| SQL Server, Oracle, Cassandra/ScyllaDB, ClickHouse, Snowflake, Redshift, MongoDB, Trino | Planned. These have native roles and grants |
| Apache Pinot, Elasticsearch/OpenSearch, Kafka, Druid | Planned. These control access through an admin API |
SQLite, DuckDB, RocksDB and LMDB will never be supported. They have no users, roles or grants. Anything that can open the file can read all of it, so there is nothing for dbauthz to manage. dbauthz reports a clear error for these engines rather than half-working.
Requires Go 1.26 or later.
make build
./bin/dbauthz version- Technology stack: frozen decisions and their reasons
- Engine reference: vendor documentation for every engine's permission model
- Engineering workflow: commits, branching, versioning and releases
- Architecture decisions
- Contributing · Security