PADION
datakeeper · Authorization & Audit
Ranger-compatible · Trino · tamper-proof audit · 4-role SoD
Policy-based access control + tamper-proof hash chain audit + anomaly detection + break-glass access + 4-role SoD. Govern column- and row-level permissions for the Trino query engine from one console under a consistent policy.
Policy Decision
Finance must prove "who · when · what data · how accessed" in a tamper-proof manner. DB GRANT alone is not enough — row/column masking, time conditions, consistent enforcement across query engines, audit integrity, separation of duty (SoD), and break-glass control must all live in one place.
PADION datakeeper preserves familiar Apache Ranger-compatible policy operations while guaranteeing records that even a DBA cannot tamper with via tamper-proof hash chain audit. Anomalies are auto-detected and blocked, break-glass access has enforced expiration, and every permission change goes through approval.
Allow / Deny / Exclude · resource hierarchy · user variable substitution · time/day/row-count conditions · policy versioning, history, copy, export.
Deeply integrated with Trino — visibility, access, and audit governed under a consistent policy. Even when time/day conditions block access, exact policy identification + blacklist updates take effect instantly.
Per-service auto-generated keys + event chain + file integrity — even a DBA cannot recompute. Auto integrity-verification scheduler built in.
Row filtering (condition + user variable) + column masking. Predefined masks (full · partial · hash · NULL) + custom SQL. Per-column mask flexibility.
Multiple rules (after-hours, bulk queries, failure storm, new IP, etc.) auto-scanned, alerted, and auto-blocked. Emergency Break-Glass grants — per user · auto expiration · separate audit trail.
4-role separation (Operator · Admin · Auditor · General) — only Auditor can change audit settings. Every policy/service/session change goes PENDING → approval → execution; even security admins log self-approvals. Role Badge in header + "My Info" page makes roles and permissions instantly visible.
A user query passes through policy evaluation · row/column isolation · tamper-proof audit before being safely served.
01 · Request
Data queries from analysts · operators · external systems
02 · Decision
User · group · resource · time conditions → Allow / Deny / Exclude
03 · Filter
Auto-apply Row Filter · Data Mask expressions
04 · Audit
Tamper-proof hash chain + auto anomaly detection
Trino Plugin
External · Read-only API
External systems (auth gateway etc.) safely query policy metadata · data lineage. API key + IP-based auth in a component isolated from operational load.
OIDC · Standard Flow
Tamper-proof hash chain + per-service keys + file integrity.
Operational ↔ Audit role separation. Only Auditor can change audit settings.
All changes PENDING → approval → execution. Security admins must route their own changes through approvals.
Predefined masks (full · partial · hash · NULL) + custom. Per-column masking.
Break-glass grants + auto expiration + separate audit trail + instant anomaly alerts.
CSRF · Rate Limit · HSTS · CSP · Open Redirect prevention · self-integrity verification.
Risky hosts blocked on external connections. Dangerous keywords in user SQL Jobs auto-blocked.
SBOM auto export (standard formats). Dependency & license governance.
Auto encryption of secrets within config files. Fail-secure if plaintext is detected at startup.
Explicit logout + auto timeout both invoke the standard OIDC end-session + token revoke flow. Other RP (Trino/Jupyter) SSO sessions are also cleared — no stale sessions.
For every audit entry (policy create/edit, session termination, etc.) the recorded author is always the real OIDC session username — forged authorship is blocked at the source.
Finance · Compliance
Prove "who, when, which column accessed" in a tamper-proof manner. Tamper-proof hash chain + SoD + approval + break-glass expiration supports finance security/audit standards.
PADION integration
Consistent policies on PADION lakehouse Trino queries. gatekeeper auth ↔ datakeeper authorization in one login / one policy flow. External integration API safely queries metadata & lineage.
Operations
Scheduled rule scan for after-hours bulk queries, new-IP patterns, break-glass usage and more — alerts + auto-blacklist provide first-line containment before operators wake up.
Analytics
Mask PII columns, restrict rows outside the user's domain via Row Filter, alert on bulk queries via row-count thresholds. Per-analyst dynamic isolation via user variables.
| Policy Model | Apache Ranger-compatible (Allow/Deny/Exclude · resource hierarchy · time/day/row-count conditions · user variables) |
|---|---|
| Supported engine | Trino (Native plugin integration) |
| Data masking | Row Filter (condition + user variable) / Data Mask (predefined + custom). Per-column masking. |
| Audit integrity | Tamper-proof hash chain + per-service auto key generation + file integrity + auto verification scheduler |
| Audit sinks | DB · File · external message queue · object storage · search engine (optional) |
| RBAC | 4 roles (Operator · Admin · Auditor · General) · SoD · permission matrix visualization |
| Authentication mode | Flexible auth modes (gateway delegation / standard OIDC) · OIDC standard flow (Authorization Code + PKCE · refresh rotation · back-channel logout) |
| Anomaly detection | Multiple rules auto-scanned · alerts + auto-block integration |
| Session control | Live query list · Kill · Blacklist (IP/user) · connection-IP allow-list · concurrent-session limit · break-glass |
| Approvals | PENDING → approval → execution pattern (policy · service · blacklist · allow-IP · concurrent sessions) |
| Scheduler | Built-in automation jobs (DB cleanup · cache · expiration · integrity · reports · anomaly) + user-defined SQL jobs |
| Monitoring | Realtime dashboard + standard metrics + email alerts + daily/weekly/monthly access reports |
| Data lineage | Lineage edges/nodes · upstream/downstream graph · external integration API |
| Architecture | Admin console + external integration API · multi-node support · Clean Architecture |
| Web security | CSRF · Rate Limit · HSTS · CSP · SSRF/Open Redirect prevention · self-integrity verification · SBOM |
| Config secrets | Auto encryption of secrets within config files · fail-secure if plaintext found |
| User menu | Header Role Badge (role color/icon) · My Info page (roles & groups visible) · approval/audit author is always the real username |
| PADION integration | gatekeeper(Auth) · data lakehouse(Data) · analyze(Analytics) |
Right after authentication — and before ETL, storage, or analytics — the access policy is decided first.
PoC, compliance validation, and full integration with your Trino environment.
