Tag

#access-control

Aug 14, 2026 · Jacob Verhoeks

Every ACL we can write, and which system enforces it

A working catalogue of the access control SQE and Spark share through Apache Ranger: object grants at the catalog, five column masks, row filters, tags that span tables, four personas built from the same primitives, and the two places the engines still render differently. Everything here is a line from a run that finished 43 of 43, on an EU bank fixture rather than a toy table. Includes the reason there are two enforcement points rather than one, and what changed when we moved every privilege write onto an authenticated endpoint.

Read

Aug 10, 2026 · Jacob Verhoeks

One policy model, two engines: access control across SQE and Spark

A complete, executable account of how SQE and Spark query the same Iceberg table under the same Apache Ranger policies: Polaris object grants, row filters, column masks, tags, precedence, writes, views, and the differences that remain.

Read

Jun 19, 2026 · Jacob Verhoeks

When GRANT becomes a Ranger policy

SQE got a second access-control backend: write GRANT/REVOKE as Apache Ranger policy and let Polaris enforce it. The protocol took an afternoon. The identity model took the week, because Polaris federation does not work the way the token suggests.

Read