Nested row access policies
Methods of referencing row access policy (RAP) protected mapping tables in a RAP for a data table are disclosed herein. An example method of referencing a mapping table in a data table using nested RAP includes defining, by a processing device, a first access policy for the mapping table to control access by specific users or under specific conditions. The processing device further defines a second access policy attached to the data table referencing the mapping table. The processing device in response to a query, executes the second access policy of the data table to provide a response or operation of data associated with the data table and the mapping table. Executing the second access policy invokes executing the first access policy of the mapping table. The executing of both the second access policy of the data table and the first access policy of the mapping table are recorded.
1. A method of referencing a mapping table in a data table, the method comprising:
defining, by a processing device, a first access policy for the mapping table to control access by specific users or under specific conditions;
defining, by the processing device, a second access policy attached to the data table referencing the mapping table;
in response to a query, executing, by the processing device, the second access policy of the data table to provide a response or operation of data associated with the data table and the mapping table, wherein executing the second access policy invokes executing the first access policy of the mapping table; and
recording the executing of the second access policy of the data table and the executing of the first access policy of the mapping table for relationship verification.
2. The method of claim 1 , wherein the response or operation of data comprises at least one of:
selecting, updating, deleting, merging, viewing, or restricting one or more thereof, the data associated with the data table and the mapping table.
3. The method of claim 2 , wherein executing the second access policy comprises:
granting, according to the second access policy, an access to steps that map to processes owned by a role whose authority is defined in the first access policy.
4. The method of claim 1 , wherein the first access policy comprises a first row access policy (RAP) protecting access to the mapping table, and wherein the second access policy comprises a second RAP created by a user to reference the mapping table at the data table.
5. The method of claim 4 , wherein the first RAP and the second RAP respectively defines relationships between roles and operation authorities.
6. The method of claim 1 , further comprising:
tracking the response or operation in response to the query and related changes to the data table and the mapping table.
7. The method of claim 1 , further comprising:
verifying an active status of a role in the query during executing the first and the second access policies.
8. The method of claim 1 , wherein defining the second access policy is based on a history of operations by a plurality of roles of the data table referencing the mapping table.
9. A machine-storage medium embodying instructions that, when executed by a machine, cause the machine to perform operations of referencing a mapping table in a data table, the operations comprising:
defining, by a processing device, a first access policy for the mapping table to control access by specific users or under specific conditions;
defining, by the processing device, a second access policy attached to the data table referencing the mapping table;
in response to a query, executing, by the processing device, the second access policy of the data table to provide a response or operation of data associated with the data table and the mapping table, wherein executing the second access policy invokes executing the first access policy of the mapping table; and
recording the executing of the second access policy of the data table and the executing of the first access policy of the mapping table for relationship verification.
10. The machine-storage medium of claim 9 , wherein the response or operation of data comprises at least one of:
selecting, updating, deleting, merging, viewing, or restricting one or more thereof, the data associated with the data table and the mapping table.
11. The machine-storage medium of claim 9 , wherein the operations further comprise:
tracking the response or operation in response to the query and related changes to the data table and the mapping table.
12. The machine-storage medium of claim 9 , wherein the operations further comprise:
verifying an active status of a role in the query during executing the first and the second access policies.
13. A system of referencing a mapping table in a data table, the system comprising:
one or more processors of a machine; and
a memory storing instructions that, when executed by the one or more processors, cause the machine to perform operations comprising:
receiving a query;
in response to the query, executing, by a processing device, a second access policy attached to the data table referencing the mapping table to provide a response or operation of data associated with the data table and the mapping table, wherein executing the second access policy invokes executing a first access policy for the mapping table to control access by specific users or under specific conditions; and
recording the executing of the second access policy of the data table and the executing of the first access policy of the mapping table for relationship verification.
14. The system of claim 13 , wherein the response or operation of data comprises at least one of:
selecting, updating, deleting, merging, viewing, or restricting one or more thereof, the data associated with the data table and the mapping table.
15. The system of claim 14 , wherein executing the second access policy comprises:
granting, according to the second access policy, an access to steps that map to processes owned by a role whose authority is defined in the first access policy.
16. The system of claim 13 , wherein the first access policy comprises a first row access policy (RAP) protecting access to the mapping table, and wherein the second access policy comprises a second RAP created by a user to reference the mapping table at the data table.
17. The system of claim 16 , wherein the first RAP and the second RAP respectively defines relationships between roles and operation authorities.
18. The system of claim 13 , wherein the operations further comprise:
tracking the response or operation in response to the query and related changes to the data table and the mapping table.
19. The system of claim 13 , wherein the operations further comprise:
verifying an active status of a role in the query during executing the first and the second access policies.
20. The system of claim 13 , wherein defining the second access policy is based on a history of operations by a plurality of roles of the data table referencing the mapping table.