sicabe-core/deploy/config/opa/authz.yml

# =============================================================================
# SiCABE — Model Authorization (SUMBER KEBENARAN) — OPA / Trino
# -----------------------------------------------------------------------------
# Berkas ini SATU-SATUNYA sumber kebenaran ACL. JANGAN mengedit
# config/opa/data.json manual — itu HASIL RENDER:
#     ./scripts/sicabe-authz render        # authz.yml -> data.json
#     ./scripts/sicabe-authz apply         # render + reload OPA
#     ./scripts/sicabe-authz fmt           # rapikan format berkas ini
# Policy Rego membaca data.authz.catalogs + grant schema (data.roles.<r>.schema_grants)
# — nama catalog/schema & cakupan GRANT TIDAK di-hardcode di Rego. Ganti nama
# catalog = ubah `catalogs:` di sini -> render -> reload. Grant tingkat-schema:
# `roles.<r>.schemas: [{schema, caps, columns}]`. Dokumentasi: docs/authorization-cli.md
# =============================================================================
version: 1
catalogs: [iceberg]
schemas: [bronze, silver, gold]
roles:
  data-admin: {superuser: true}
  data-engineer:
    grants:
    - table: bronze.orders
      caps: [select, write, ddl]
      columns: '*'
    - table: bronze.orders_incremental
      caps: [select, write, ddl]
      columns: '*'
    - table: silver.orders_silver
      caps: [select, write, ddl]
      columns: '*'
    - table: gold.orders_gold
      caps: [select, write, ddl]
      columns: '*'
    schemas:
    - schema: bronze
      caps: [select, write, ddl]
      columns: '*'
    - schema: silver
      caps: [select, write, ddl]
      columns: '*'
    - schema: gold
      caps: [select, write, ddl]
      columns: '*'
  data-catalog:
    grants:
    - table: bronze.orders
      caps: [select]
      columns: '*'
    - table: bronze.orders_incremental
      caps: [select]
      columns: '*'
    - table: silver.orders_silver
      caps: [select]
      columns: '*'
    - table: silver.orders_clean
      caps: [select]
      columns: '*'
    - table: gold.orders_gold
      caps: [select]
      columns: '*'
  data-analyst:
    grants:
    - table: gold.orders_gold
      caps: [select]
      columns: '*'
    - table: silver.orders_silver
      caps: [select]
      columns: [id, total_value]
  data-viewer: {}
users: {svc_dbt: data-engineer, svc_airflow: data-engineer, svc_seed: data-engineer, svc_om: data-catalog}