# Security & Access Control

Implement row-level security, role-based access, data masking, and field-level encryption.

## Overview

Prax provides comprehensive security features including Row-Level Security (RLS), role management, fine-grained grants, and data masking.

Feature | PostgreSQL | MySQL | SQLite | MSSQL | MongoDB
--- | --- | --- | --- | --- | ---
Row-Level Security | ✅ | ❌ | ❌ | ✅ | ✅ Field-level
Column-Level Grants | ✅ | ✅ | ❌ | ✅ | ✅
Roles & Users | ✅ | ✅ | ❌ | ✅ | ✅
Data Masking | ✅ | ✅ Enterprise | ❌ | ✅ | ✅
Field Encryption | ✅ pgcrypto | ✅ | ❌ | ✅ | ✅ CSFLE

## Row-Level Security (RLS)

Automatically filter rows based on security policies. Users only see data they're authorized to access.

## Multi-Tenant Isolation

Implement tenant isolation with RLS policies tied to session variables or JWT claims.

Best Practice: Use RLS for tenant isolation instead of WHERE clauses. It's enforced at the database level, preventing accidental data leaks in application code.

## Role Management

Create hierarchical roles with inherited privileges.

## Grants & Privileges

Grant fine-grained permissions at table, column, or schema level.

## Dynamic Data Masking

Mask sensitive data for non-privileged users without changing the stored data.

## Connection Profiles

Configure named connection profiles with security settings.

## MongoDB Security

MongoDB role-based access control and Client-Side Field Level Encryption (CSFLE).

## Best Practices

#### Principle of Least Privilege

Grant only the minimum permissions needed. Use role hierarchies to manage permissions centrally and revoke easily.

#### Use RLS for Multi-Tenancy

RLS policies are enforced at the database level, making it impossible for application bugs to leak data between tenants.

#### Audit Security Changes

Log all role and permission changes. Use migrations for security changes so they're version controlled and reviewable.

#### Encrypt Sensitive Data

Use CSFLE (MongoDB) or pgcrypto (PostgreSQL) for sensitive fields. Encryption protects data even if the database is compromised.