v0.9.0: Row-Level Security in SLayer Python API

SLayer 0.9.0

Adds row-level security: scope every query a session runs to a single tenant.

Configure a policy once when you build the engine (or a local-engine SlayerClient), and every query is filtered automatically - across joins, CTEs, sql-mode sub-queries, and query-backed stages - with no model or query changes. The scoping is immutable engine state an agent cannot read or override.

from slayer.core.policy import SessionPolicy, ColumnFilterRule

policy = SessionPolicy(data_filters=[
    ColumnFilterRule(column="organization_uuid", value="7ef3ab6c-..."),
])
engine = SlayerQueryEngine(storage=storage, policy=policy)

Pass a single value for column = value or a list for column IN (...). Tables that lack the column either fail the query (on_unapplicable="block", the default) or pass through unfiltered ("pass"); a table whose column can't be verified always fails closed. Values are bound literals, so the rewrite is injection-safe.

Python API only for now. See the Row-Level Security guide.