Constructive Security

The Constructive Authz authorization protocol and its SDK integration — expressing authorization as Authz* policy nodes and applying them via RLS, grants, and the secureTableProvision workflow.

When to Apply

Use this skill when:

• Securing tables with RLS policies (Authz* types)
• Creating grants (select/insert/update/delete per role)
• Using secureTableProvision to provision fields + grants + policies + RLS in one call
• Understanding permissive vs restrictive policy composition
• Configuring storage bucket security policies
• Working with read-only access (AuthzNotReadOnly)
• Understanding capability defaults, capability kinds, and module-level capabilities
• Deciding where to gate access that an owner or admin must not bypass
• Adding session-level guards (GuardStepUp) that require MFA/password before DML
• Protecting individual infrastructure rows from accidental deletion or edits (DataLock)
• Replacing the grants or policies a module installed on a table it generated (registries, images, repositories, machines, functions)