Fine-Grained Access Control

// Make source publicly accessible
# authorize public
source: public_airports is airports extend {
  dimension:
    has_control_tower is cntl_twr = 'Y'
    major_airport is passenger_count > 100000

  measure:
    airport_count is count()
}

// Restrict to specific group
# authorize [ "group:admin@faa.gov" ]
source: admin_airports is airports extend {
  dimension:
    classified_status is status_code

  measure:
    total_budget is sum(annual_budget)
}

// Filter rows by user's group membership
# authorize [ "group:atc@faa.gov" ]
source: atc_airports is airports extend {
  // Air traffic controllers only see airports with control towers
  where: cntl_twr = 'Y'
}

// Dynamic filtering: bind user's group at runtime
# bind [ "ext_group_id:SESSION_GROUP()" ]
source: group_airports(ext_group_id: string) is airports extend {
  // Users only see airports belonging to their group
  where: group_id = ext_group_id
}

// Alternative: join to user attributes table (similar to BigQuery pattern)
# authorize [ "group:admin@faa.gov" ]
source: user_attributes(user_id: string) is
  duckdb.table('../data/user_attributes.parquet') extend {
  where: user_attributes.user_id = user_id
}

# bind [ "ext_user_id:SESSION_USER()" ]
source: my_airports(ext_user_id: string) is airports extend {
  join_one: user_attributes(ext_user_id)
    inner on group_id = user_attributes.group_id
}

// Full source with all fields - admin only
# authorize [ "group:admin@faa.gov" ]
source: airports_full is duckdb.table('../data/airports.parquet') extend {
  dimension:
    code is airport_code
    name is airport_name
    city is city_name
    security_clearance is clearance_level
    classified_operations is ops_classified

  measure:
    airport_count is count()
    total_security_incidents is sum(security_incidents)
}

// Public view excludes sensitive fields
# authorize public
source: airports_public is airports_full include {
  code, name, city, airport_count
}

// Using access modifiers
source: customers is duckdb.table('../data/customers.parquet') extend {
  public dimension:
    customer_id is id
    company_name is company

  internal dimension:
    credit_score is credit_rating

  private dimension:
    ssn is social_security_number

  public measure:
    customer_count is count()
}

// File-level: applies to all sources in file
## authorize public

source: source1 is table1 extend { ... }
source: source2 is table2 extend { ... }

// Source-level: overrides file-level default
# authorize [ "group:admin@company.com" ]
source: sensitive_data is data extend { ... }

# bind [ "user_id:SESSION_USER()" ]
# bind [ "group_id:SESSION_GROUP()" ]
# bind [ "region:SESSION_REGION()", "dept:SESSION_DEPARTMENT()" ]

Client Request
    ↓
Gateway / Authorization Service
    ├── 1. Extract user identity from auth token
    ├── 2. Fetch #authorize annotations from Publisher
    ├── 3. Evaluate authorization rules
    ├── 4. Fetch #bind annotations from Publisher
    ├── 5. Retrieve user attribute values
    ├── 6. Inject parameters into query
    ↓
Publisher (executes query with parameters)
    ↓
Results (filtered by row/field ACLs)

# bind [ "user_region:SESSION_REGION()" ]
source: regional_sales(user_region: string) is sales extend {
  where: region = user_region

  dimension:
    region is sales_region
    product is product_name

  measure:
    total_revenue is sum(revenue)
    order_count is count()
}

# bind [ "tenant_id:SESSION_TENANT()" ]
source: tenant_data(tenant_id: string) is app_data extend {
  where: customer_id = tenant_id

  dimension:
    user_name is name
    user_email is email

  measure:
    active_users is count(distinct user_id)
}