The database holds secrets. Not all rows should be seen by all eyes. Hashicorp Boundary now makes it possible to control access to individual rows with precision. This is row‑level security tied directly to identity‑driven access.
Boundary already manages secure access to systems without distributing credentials. It brokers sessions through defined roles, scopes, and policies. Row‑level security takes this further. Instead of just deciding who can reach the database, it decides which specific data they can query once inside.
This works by integrating Boundary’s identity grants with database policies. You define a set of constraints based on user or group attributes. These constraints filter results at the SQL engine before they leave the database. A single connection can carry multiple users’ contexts, each returning only authorized rows. This avoids the risks of shared credentials or coarse‑grained roles.
Row‑level security with Boundary is straightforward to implement. Set up your Boundary environment. Configure the database to apply row‑level policies. Map Boundary user attributes into session variables. The database evaluates every query against these variables. Unauthorized rows never appear. There is no need for the application layer to handle filtering. Security remains enforceable even if the application is compromised.
Performance impact is minimal when policies are well‑indexed. You retain centralized control in Boundary, while databases execute row filters locally. This makes auditing simpler. Every query and decision can be logged with a link back to a specific Boundary identity. Compliance teams can trace access to the exact row.
Hashicorp Boundary row‑level security is essential when handling multi‑tenant data, sensitive records, or regulated datasets. It closes the gap between “who can connect” and “what they can see.” Control becomes exact, enforceable, and visible.
See it in action with live row‑level policies inside your own environment. Try it now at hoop.dev and see secure, filtered access working in minutes.