DOSFI LogoDOSFI
Sync:MeshFederationSearchGovernanceDirectoryIdentityAll Systems Synced
RLS-ENFORCEMENT-CYCLE

Runtime RLS Readiness Report

Closed Core enforcement verification across the 5 core runtime entities. Admin-only writes, role-scoped reads, and denied-access audit logging.

Final Verdict: PASS

All 5 runtime entities have full RLS enforcement. Closed Core policy is active.

01Entity RLS Matrix
EntityRead RuleCreateUpdateDeleteRead Scope
Nodeuser | adminadmin-onlyadmin-onlyadmin-onlyAuthenticated users (read-only)
Taskcreated_by_id | adminadmin-onlyadmin-onlyadmin-onlyOwner-scoped (creator + admin)
NodePooluser | adminadmin-onlyadmin-onlyadmin-onlyAuthenticated users (read-only)
RoutingLogadmin | observabilityadmin-onlyadmin-onlyadmin-onlyAdmin + observability role only
ShardDirectoryuser | adminadmin-onlyadmin-onlyadmin-onlyAuthenticated users (read-only)
02Backend Function Role Checks
requireAdmin

All writes on Node, Task, NodePool, RoutingLog, ShardDirectory

requireAuthenticated

Reads on Node, NodePool, ShardDirectory

requireTaskOwnerOrAdmin

Reads on Task (owner-scoped)

requireObservabilityOrAdmin

Reads on RoutingLog

03Denied-Access Audit Pipeline

RuntimeAccessAudit Entity

Dedicated audit entity for denied access attempts. Admin-only reads; open create for logging.

DEPLOYED

Audit Records

Denied access attempts logged to the database.

0records

Closed Core Policy

No external writes from non-admin roles. All 5 entities enforce admin-only create/update/delete.

ENFORCED
04Enforcement Summary

RLS Policies

  • Node — read: authenticated, write: admin-only
  • Task — read: owner-scoped, write: admin-only
  • NodePool — read: authenticated, write: admin-only
  • RoutingLog — read: admin/observability, write: admin-only
  • ShardDirectory — read: authenticated, write: admin-only

Role Check Coverage

  • Shared module: base44/shared/runtimeAccess.ts
  • 4 role-check functions deployed
  • Denied-access audit logging active
  • Closed Core: no external writes from non-admin