mirror of
https://github.com/lancedb/lancedb.git
synced 2026-11-14 22:56:54 +00:00
Jack YeandClaude Sonnet 5
de95ed3f6d
A broad documentation pass across the areas LanceDB Enterprise and Embedded diverge on most: **Data Curation** -- GPU Function execution, Slurm scheduling (and what Slurm is, for readers new to it), blob late materialization as its own page, joins, aggregation/profiling, sampling, near-duplicate detection, chunking, distributed shuffle, and IVF-partition clustering. **Feature Engineering** -- computed columns and materialized views, restructured to lead with the Function-based path and show the SQL form side by side with Python throughout; a single Auto Refresh page instead of duplicating scheduling details on every refresh page; adaptive execution; checkpointing; GPU and Slurm placement for refresh workers; a Training Cache page for the PyTorch data loader's automatic cache benefit. **Security & Governance** -- an Audit Log reference (schema, access, grants), Secrets promoted to an ordinary catalog object with their own SQL DDL and a vending/rotation guide, and privilege-table fixes verified against the authorization source. **Deployment & Maintenance** -- Horizontal Scaling and OpenTelemetry moved into a real Deployment area; Automated Cleanup folded into Intelligent Auto-Maintenance (every other maintenance decision already lived there); RTE Compaction and Advanced Conflict Resolution documented in depth. **Landing page** -- the Enterprise feature comparison table reorganized (several redundant or stale rows removed, several new areas added), and the "why Enterprise" bullets replaced with ones tied to a concrete page (Performance, Scale, Fault tolerance, Multicloud deployment, Simplify operations) instead of vague promises. Plus a full pass addressing lancedb-gatekeeper's review: a real test-safety bug (a quickstart test could silently overwrite and delete a deployment's own `frames` table), a fabricated SQL statement with no backing implementation, an actual dedup-guarantee bug in `take_row_ids`, and dozens of documentation-accuracy fixes verified against source rather than taken on faith -- each either fixed, or left with an explicit note on why it needs a feature or deployment owner's sign-off instead of being guessed at. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_018PXMCbRH6i5w47TsjeEUMT --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
53 lines
2.0 KiB
Plaintext
53 lines
2.0 KiB
Plaintext
---
|
|
title: "Authorization"
|
|
sidebarTitle: "Authorization"
|
|
description: "Who may do what: an overview of LanceDB Enterprise's access control model."
|
|
icon: shield-halved
|
|
keywords: ["authorization", "authz", "privileges", "rbac", "access control", "grant", "revoke"]
|
|
availability:
|
|
embedded: unavailable
|
|
enterprise: available
|
|
---
|
|
|
|
[Authentication](/enterprise/authentication) establishes who is calling.
|
|
Authorization decides what they may do.
|
|
|
|
An access control entry grants **one privilege** on **one object** to **one
|
|
subject**. Everything on the Principals and Privileges pages is a
|
|
consequence of that shape.
|
|
|
|
## Granting a privilege {#granting}
|
|
|
|
`GRANT` and `REVOKE` cover every object in the catalog -- system, database,
|
|
schema/namespace, table, view, materialized view, secret, function, and
|
|
storage integration. A Secret, the one a day-to-day user shares most
|
|
often, looks like this:
|
|
|
|
<CodeGroup>
|
|
```sql SQL icon="database"
|
|
GRANT USAGE ON SECRET platform.`openai-prod` TO ROLE research
|
|
REVOKE USAGE ON SECRET platform.`openai-prod` FROM ROLE research
|
|
```
|
|
</CodeGroup>
|
|
|
|
The caller must already hold `OWNERSHIP` on the object being granted (`GRANT`
|
|
additionally requires the object to already exist; `REVOKE` does not, so an
|
|
entry left on a dropped object can still be removed). A role need not exist
|
|
beforehand, but a `USER` or `GROUP` name must resolve to exactly one identity
|
|
in your identity provider, or the statement fails.
|
|
|
|
See [Privileges](/governance/privileges) for the full statement syntax and
|
|
every privilege each operation needs. See [Principals](/governance/principals)
|
|
for who a grant can name.
|
|
|
|
## What to read next {#next}
|
|
|
|
<CardGroup cols={2}>
|
|
<Card title="Principals" icon="user" href="/governance/principals">
|
|
Users, groups, and roles -- where each comes from, and how a grant names one.
|
|
</Card>
|
|
<Card title="Privileges" icon="key" href="/governance/privileges">
|
|
Every object's privileges, and the GRANT/REVOKE syntax that covers them.
|
|
</Card>
|
|
</CardGroup>
|