Security model

The guarantee: a plan that the verifier accepts returns only data the requester may see, and its result does not change when other tenants' data changes.

Who is trusted

Only the verifier and the definitions of the operators. The gateway, the optimizer, caches, internal jobs and future learned components are all treated as untrusted plan authors. Every data node checks every plan before running it, whoever produced the plan.

The requester's identity comes only from verified credentials, never from headers or fields a client or a gateway asserts.

What the guarantee covers

• Rows of other tenants never reach a result, an aggregate, a sort or a limit that decides what you see.
• Rows hidden by the access policy, and fields above the requester's clearance, are treated the same way.
• The guarantee holds for a plan regardless of how it was produced: by the optimizer, from the plan cache, or by hand.

How the verifier establishes this is described in the specification shared with early-access teams. The property itself is tested on ten million generated queries and proved for the core operators; see How we test.

Known gaps

• Row-level policies are not yet enforced; today tenant isolation is the access boundary.
• Timing and result-size side channels are not covered by the guarantee; they will be listed with their mitigations in a public leakage register.