Security model
Permission Layers (broadest to finest)
- Workspace roles: Admin, Member, Contributor, Viewer
- Item-level permissions: Read, ReadData, ReadAll
- SQL granular permissions: GRANT/DENY/REVOKE
Key Principles
- Admin/Member/Contributor roles grant full data read and bypass RLS/CLS/DDM
- Use Viewer role + SQL GRANT for least-privilege consumer access
- Sharing an item with no extra permissions → CONNECT only (can't read tables until GRANT SELECT)
- "Read a
[Description truncada. Veja o README completo no GitHub.]