Security & Access
This section covers who can reach an AetheriusDB cluster, what they can see once they connect, and how the bytes move on the wire. It spans four practical concerns — access control, network security, and protocol choice — plus one forward-looking capability, the encrypted zero-trust engine.
Why it matters
Section titled “Why it matters”Access control here is built into the engine, not bolted on with an external proxy. Roles, row-level policies, TLS, and auth tokens are first-class, so a tenant sees only its own rows by construction, and you don’t run a separate gateway to enforce it. Standard wire protocols mean your existing drivers connect without custom clients.
- Least privilege, per row — row-level security filters each query to the caller’s rows, so multi-tenant isolation is enforced in the database itself.
- One system to secure — auth, encryption, and access control live in the server; there’s no sidecar auth proxy to deploy and keep in sync.
- Connect with what you have — the server speaks native, PostgreSQL, and Arrow Flight SQL at once, so standard drivers work as-is.
Without a latency tax
Section titled “Without a latency tax”Row-level security is applied as a plan-time filter, so isolation costs you a predicate, not a scan — enforced rows are pruned as part of the query, not checked row-by-row afterward. And the native binary protocol is deliberately low-overhead, so a secured connection isn’t a slow one.
Pages in this section
Section titled “Pages in this section”- RBAC & Row-Level Security — define named roles, grant privileges, and attach row-level policies so each user or tenant sees only their own rows. Stable.
- Remote Connectivity Security — TLS, bearer auth tokens, and connecting safely over an untrusted network. Stable.
- Wire Protocols — the three protocols the server speaks at once (native, PostgreSQL pgwire, Arrow Flight SQL) and how to pick one. Stable.
- Aether-Sync (Native Protocol) — the low-overhead native binary protocol that the Python client speaks. Stable.
- Zero-Trust FHE Engine — computing over encrypted columns so the server never sees plaintext. Roadmap — verify before relying on it.
Every feature page carries an availability badge (Stable / Opt-in / Beta / Roadmap). The authoritative list of flags and defaults lives in Configuration & Availability.