Catalog-aware mapping
Aliases, casts, stars, and supported nested PostgREST selections resolve back to concrete schema columns.
Schema-aware data masking
Mask the value before it crosses the boundary.
Define sensitive columns with explicit schema, table, and column rules. Safe Boundary maps query output to the catalog and returns type-compatible masked values.
Configured column maskingMask configured values before return
Rules matchedDATABASE RESULTemail: ada@acme.iossn: 123-45-6789phone: 415-555-0182
Mask engineCatalog + type aware
PROTECTED RESULTa••@acme.io•••-••-6789•••-•••-0182
3 COLUMNS
Why this exists
Configuration first, deterministic enforcement after
The current product does not sample arbitrary cell values or promise autonomous data discovery. Operators define the naming rules that identify protected columns; Safe Boundary applies those rules consistently to supported PostgreSQL, MCP, and PostgREST reads.
Masking is applied in the response path or through SQL-aware projection rewriting, depending on the surface. If protected output cannot be safely mapped or represented, enforce mode can refuse it instead of returning raw data.
What it does
Concrete controls, stated precisely.
Type-shaped output
Masks preserve compatible JSON and database types so clients do not receive a string where a UUID, number, or boolean is expected.
Fail closed
Unknown or unredactable protected output is blocked in enforce mode instead of silently passing through.
Mask shape
Protect the value while keeping the response usable.
| Decision | Configured field | Illustrative raw value | Illustrative masked value |
|---|---|---|---|
| alice@example.com | masked@example.invalid | ||
| account_id | 9f1c… | 0000… | |
| amount / boolean | Type-specific source value | Compatible typed output |
How it works
A visible enforcement sequence.
Name
Define schema, table, and column patterns for data that must not leave raw.
Observe
Run representative traffic and review would-mask decisions.
Refine
Adjust rules for aliases, data types, and intentionally public fields.
Enforce
Turn on masking and fail-closed behavior for protected output.
Protected when
- ✓Columns matched by configured policy rules
- ✓Supported PostgreSQL results and PostgREST JSON or CSV
- ✓Reads that map unambiguously to the live catalog
Important boundaries
- •Automatic discovery by inspecting data values is not a current feature
- •Masking does not replace upstream grants and RLS
- •Unrouted protocols and direct database endpoints are outside the boundary
Continue the story
Related Safe Boundary pages
Supabase REST protection →
Mask PostgREST responses and stop filters from becoming inference oracles.
SQL-aware enforcement →
See the supported projection rewrite boundary.
Security model →
Understand trust boundaries, credentials, identity, and bypass conditions.
Test the boundary on a real access path.
Start in observe mode and validate the policy against representative traffic before you enforce it. That gives the team evidence for each decision, along with explicit bypass controls for the cases that need a deliberate exception.