mirror of
https://github.com/lancedb/lancedb.git
synced 2026-10-14 07:42:28 +00:00
Jack Ye
70c10e4aa4
lancedb now holds a page at every path the site publishes, including the twelve Enterprise ones. Those are real open-source pages -- what the capability is, and what the embedded form does instead -- rather than blank placeholders, so the open-source site is complete on its own. sophon becomes an overlay whose page replaces the one at the same path, which means navigation lives in one place and the two repositories only have to agree on a path. That removes the whole class of problem where a page could only be reached from one of the two trees. The open-source site went from twenty-four dangling Enterprise links to one, and that one points at the dataset pages the build repository owns. Ports four changes that landed on the docs repository after this branch left it: #344 indexing and quantization rewritten #354 LeRobot native reader #361 training/index renamed to training/data-loading and rewritten #362 distance metric mismatch falls back to a brute-force scan None applied as patches, because these files were merged or split here -- quantization into the vector index page, multi-vector into vector search, performance into four pages. Each was ported by taking the upstream page and re-applying the restructure on top, which also picked up a correction that would otherwise have been lost: the stricter brute-force threshold for multi-vector columns is a Cloud limit, not an Enterprise one. The upstream LeRobot page linked to a Geneva page that no longer exists; it now points at the feature-engineering pages that replaced it.
27 lines
1.1 KiB
Plaintext
27 lines
1.1 KiB
Plaintext
---
|
|
title: "Authorization"
|
|
sidebarTitle: "Authorization"
|
|
description: "Who may do what: privileges granted on catalog objects to principals, groups, roles, and API keys."
|
|
icon: shield-halved
|
|
keywords: ["authorization", "authz", "privileges", "rbac", "access control"]
|
|
---
|
|
|
|
<Badge color="red">Enterprise</Badge>
|
|
|
|
This page describes a LanceDB Enterprise capability. The embedded form
|
|
of LanceDB has no server to provide it -- see
|
|
[Architecture](/architecture) for what differs between the two.
|
|
|
|
[Authentication](/enterprise/authentication) establishes who is calling.
|
|
Authorization decides what they may do.
|
|
|
|
An access control entry grants **one privilege** on **one object** to **one
|
|
subject**. Objects are addressed by kind and path -- `system`, `database:db`,
|
|
`namespace:db/ns`, `table:db/ns/table` -- and the hierarchy is not decorative:
|
|
reaching a table requires `USAGE` on the namespace containing it and on the
|
|
database containing that.
|
|
|
|
Embedded LanceDB has no such layer. Access is whatever the object store
|
|
enforces on the bucket or directory, which is coarser and has no concept of a
|
|
table.
|