Builtin Rule Reference

This page lists all builtin rules that ship with Lexega. These rules are evaluated automatically unless disabled with --no-builtin.

Usage in policies: Reference any rule by its ID:

policies:
  - rule_id: SNW-STG-ENC-OFF  # Stage Encryption Disabled
    action: block
    envs: [prod]

Query Analysis (Q-xxx)

Rule IDRiskDescription
Q-JOIN-CROSS-CENH🟡 mediumCross join between {witness.left.name.raw} and {witness.right.name.raw} on a catalog-attested cartesian product of {witness.cartesian_estimate} rows. May cause performance issues on large tables. [Catalog-enhanced]
Q-SCAN-NOFILT🟡 mediumQuery reads multiple tables without an effective WHERE filter or LIMIT clause. This may cause full table scans.
Q-SCAN-1TBL🟡 mediumSELECT without an effective WHERE filter or LIMIT clause on table. May cause full table scan. Use tables.none_of to allowlist known-small tables.
Q-WIN-NOPART🟡 mediumWindow function without PARTITION BY operates over entire result set. This may cause performance issues or unexpected results.
Q-WIN-RANK-NOORD🟡 mediumROW_NUMBER/RANK/DENSE_RANK without ORDER BY produces arbitrary ordering. Results are non-deterministic.
Q-NULL-NOTIN🟠 highNULL-logic hazard: NOT IN with subquery on column '{column}'. If subquery returns any NULL, entire predicate evaluates to UNKNOWN and filters all rows. Use NOT EXISTS or ensure subquery has WHERE ... IS NOT NULL.
Q-PRED-CONTRA🔴 criticalContradictory equality: predicate can never be true (e.g., WHERE a=1 AND a=2). Query will return zero rows.
Q-PRED-RANGE🟠 highImpossible range: predicates define an empty range (e.g., WHERE x>10 AND x<5). Query will return zero rows.
Q-PRED-TAUTOLOGY🟡 mediumTautological predicate: condition is always true (e.g., WHERE x=1 OR x<>1). The WHERE clause provides no filtering.
Q-PRED-REDUNDANT🟢 lowRedundant predicate: condition is already implied by another predicate (e.g., WHERE x>5 AND x>3). The weaker predicate has no effect.
Q-AGG-MANYDIM🟡 mediumGROUP BY with many columns (>5) may indicate design issues or produce sparse results.
Q-SUBQ-SCALAR🟡 medium|
Q-AGG-NOFILT🟢 lowAggregate query without effective WHERE filter. Consider adding filters to avoid processing entire tables.
Q-SUBQ-CORR-SEL🟠 highCorrelated scalar subquery (N+1 query pattern). Consider rewriting as JOIN for better performance.
Q-SUBQ-CORR-WHERE🟡 mediumCorrelated subquery in WHERE/IN clause. May cause performance issues on large datasets. Consider rewriting with EXISTS or JOIN.
Q-AGG-NONDET🟡 mediumNon-deterministic expression in GROUP BY context. Results may vary between executions with same data.
Q-WIN-NONDET🟠 highNon-deterministic expression in window function. Results may vary between executions with same data.
Q-NONDET🟡 mediumQuery contains non-deterministic elements. Results may vary between executions.
Q-WIN-MULTIPART🟡 mediumMultiple window functions with different PARTITION BY clauses. Query will re-partition data multiple times, causing additional shuffles.
Q-TBL-UNBOUNDED-CENH🟠 highUnbounded query on large table — WHERE clause is absent or tautological. Consider adding filters to reduce data scanned. [Catalog-enhanced]
Q-TBL-SELSTAR-WIDE-CENH🟡 mediumSELECT * on wide table (50+ columns). Scanning many unnecessary columns increases I/O and network transfer. Consider explicit column selection. [Catalog-enhanced]
Q-AGG-NOFILT-CENH🟡 mediumAggregating a large table (1M+ rows) without effective WHERE filter. Consider adding time/partition filters to reduce scan size. [Catalog-enhanced]
Q-WIN-NOPART-CENH🟠 highWindow function without PARTITION BY operates on entire large table (1M+ rows) in single partition. Add PARTITION BY to reduce memory pressure. [Catalog-enhanced]
Q-WIN-UNBOUNDED-CENH🔴 criticalWindow function with unbounded frame and no PARTITION BY. Extremely expensive on large datasets - entire table processed as one partition. [Catalog-enhanced]
Q-WIN-HICARD-CENH🟠 highWindow function partitioned on high-cardinality column. May cause performance issues. [Catalog-enhanced]
Q-WIN-USAGE🟢 lowWindow function usage detected. Verify PARTITION BY and ORDER BY clauses.
Q-PROP-CONTRA🔴 criticalCross-scope contradiction: consumer predicate contradicts upstream CTE/subquery constraint. Query will always return zero rows from the upstream source.
Q-SUBQ-REPEAT🟡 mediumRepeated subquery pattern detected. Consider using CTEs or temporary tables for better readability and potential performance improvement.
Q-WIN-FRAME🟢 lowCustom window frame specification detected. Verify boundaries.
Q-JOIN-TYPEMIS-CENH🟡 mediumJOIN on columns with mismatched data types. This causes implicit type conversion and may prevent index usage, resulting in slower queries. [Catalog-enhanced]
Q-JOIN-NULL-CENH🟠 highJOIN on nullable column silently excludes NULL values. NULL values in this column will not match, potentially losing data. Consider LEFT JOIN or add IS NOT NULL filter. [Catalog-enhanced]
Q-FLOW-DROP-REF🔴 criticalStatement references a table or view that was dropped by a prior statement in this script. This statement will fail at runtime.
Q-FLOW-RENAME-REF🟠 highStatement references a table by its old name after it was renamed by a prior statement in this script. Use the new name or reorder the statements.
Q-FLOW-COL-DROP🔴 criticalStatement references a column that was dropped by a prior ALTER TABLE statement in this script. This statement will fail at runtime.
Q-FLOW-TAINT⚪ infoOutput column derives from a classified source (catalog tag). When materialized by a privileged role (e.g. dbt service account), source masking policies do not protect the destination table. Ensure the destination has its own masking policy or access controls.
Q-NULL-COUNT-CENH🟠 highCOUNT({column}) on confirmed nullable column excludes NULL values. This column is nullable per catalog metadata. If counting all rows including NULLs, use COUNT(*) instead. [Catalog-enhanced]
Q-VIEW-REF-CENH🟡 mediumQuery references VIEW(s). Views are recomputed on every execution (not materialized). [Catalog-enhanced]
Q-AGG-HICARD🟡 mediumGROUP BY includes high-cardinality columns (IDs, emails, etc.). This can generate millions of groups causing memory pressure.
Q-NULL-NEQ🟡 mediumNULL-logic warning: <> or != operator on column(s) [{witness.column.name.raw}] will not match NULL values. If NULLs are valid data, use 'OR column IS NULL' or IS DISTINCT FROM.
Q-JOIN-FKVIOL-CENH🔴 criticalJOIN doesn't follow defined foreign key relationship. The FK constraint specifies different columns than those used in the JOIN, which is likely a logic error. [Catalog-enhanced]
Q-JOIN-LEFT-FILT🔴 criticalLEFT JOIN nullable side filtered in WHERE clause. This effectively converts the LEFT JOIN to an INNER JOIN, likely a bug.
Q-JOIN-TEMPORAL-CENH🟡 mediumTemporal join without explicit date bounds. This may cause full table scans or incorrect results across time periods. [Catalog-enhanced]
Q-MULTI-TEMPORAL-CENH🟡 mediumTables with temporal columns (DATE/TIMESTAMP) are joined without date filter in WHERE or JOIN ON. This can cause unbounded historical joins with poor performance. [Catalog-enhanced]
Q-JOIN-DISTINCT-MASK🟡 mediumDISTINCT may be masking a join fan-out. If the join produces duplicate rows, DISTINCT hides rather than fixes the issue. Consider verifying join cardinality or using EXISTS.
Q-JOIN-DISTINCT-MASK-CENH🟠 highDISTINCT confirmed to mask a join fan-out. Catalog shows join keys lack unique constraints, meaning the join will produce duplicates. DISTINCT hides this bug rather than fixing it. [Catalog-enhanced]
Q-JOIN-FANOUT-CENH🟠 highJoin produces row multiplication (1:N relationship). Aggregates or counts may be inflated. Consider using a subquery or window function. [Catalog-enhanced]
Q-AGG-EXPLODE-CENH🟡 mediumMultiple joins with aggregation but no effective WHERE filter. This can cause exponential row explosion and incorrect aggregates. [Catalog-enhanced]

DML Signals (DML-xxx)

Rule IDRiskDescription
DML-WRITE-UNBOUNDED🔴 criticalUnbounded write operation detected - the statement has no WHERE clause or its WHERE clause matches every row. This affects ALL rows in the target table(s).
DML-WRITE-XSCHEMA🟡 mediumCross-schema write operation detected. Verify schema permissions and change control procedures.
DML-WRITE-MULTITBL🟢 lowWrite operation affects multiple tables. Verify transaction boundaries and rollback plan.

Credential Exposure (CRED-xxx)

Rule IDRiskDescription
CRED-AWS-LEAK🔴 criticalHardcoded AWS access key detected (AKIA.../ASIA...). Never commit credentials to source code. Use secure parameter passing, secrets managers, or storage integrations instead.
CRED-PWD-LEAK🔴 criticalHardcoded password detected in SQL. Use secure parameter passing (e.g., :password_param) or secrets management instead of literal passwords.
CRED-APIKEY-LEAK🔴 criticalHardcoded API key or access token detected. Store API keys in secure secrets managers, not in SQL code.
CRED-CONNSTR-LEAK🔴 criticalConnection string with embedded credentials detected (user:password@host). Use secure credential storage instead of embedding credentials in URLs.

Table Operations (TBL-xxx)

Rule IDRiskDescription
TBL-DROP🔴 criticalDROP TABLE detected. Table and all data will be permanently deleted.
TBL-TRUNCATE🔴 criticalTRUNCATE TABLE detected. All rows will be permanently deleted.
TBL-REPLACE🟠 highCREATE OR REPLACE TABLE detected. Existing table definition (and potentially data semantics) is replaced.
TBL-RENAME🟡 mediumALTER TABLE RENAME detected. Downstream references (queries, views, jobs) may break if not updated.
TBL-COL-ADD🟢 lowALTER TABLE ADD COLUMN detected. Schema expanded; verify downstream contracts and ingestion mappings.
TBL-COL-DROP🟠 highALTER TABLE DROP COLUMN detected. Column data and dependent objects may be lost or broken.
TBL-MASK-ADD🟢 lowColumn masking or projection policy added. Positive governance signal.
TBL-MASK-RMV🔴 criticalMasking or Projection Policy removed from column. This exposes PII or sensitive data.
TBL-RAP-ADD🟢 lowRow Access Policy added to table. Positive governance signal.
TBL-RAP-RMV🟠 highRow Access Policy removed from table. This may expose sensitive data to unauthorized users.
TBL-RAP-RMV-ALL🔴 criticalAll Row Access Policies dropped from table. All row-level access controls removed from this table.
TBL-AGGPOL-RMV🟡 mediumAggregation or Join Policy removed from table. This may allow unrestricted data aggregation or joins.
TBL-TAG-ADD🟢 lowTag added to object. Positive governance signal.
TBL-TAG-RMV🟡 mediumTag removed from object. Governance metadata may be incomplete.

View Operations (VIEW-xxx)

Rule IDRiskDescription
VIEW-REPLACE🟡 mediumCREATE OR REPLACE VIEW detected. Existing view definition is replaced and downstream logic may change.
VIEW-CHG🟡 mediumALTER VIEW changes a view definition or attributes. Views control data access patterns; changes affect all queries through the view.
VIEW-DROP🟡 mediumDROP VIEW removes a view. Dependent queries and applications will break. Check for CASCADE to identify cascading object removal.
VIEW-CASCADE-DROP🟠 highDROP VIEW ... CASCADE removes the view AND all dependent objects (other views, rules). Cascading drops can silently remove data access controls.

Schema Operations (SCHEMA-xxx)

Rule IDRiskDescription
SCHEMA-DROP🔴 criticalDROP SCHEMA detected. All objects in schema will be permanently deleted.
SCHEMA-NAME-CHG🟡 mediumSchema renamed. Verify all references to the old name are updated.
SCHEMA-PROPS-CHG🟡 mediumSchema properties modified. Configuration change may affect behavior.
SCHEMA-TAG-ADD🟢 lowSchema tag assigned. Governance metadata updated.
SCHEMA-TAG-RMV🟡 mediumSchema tag removed. Governance metadata may be incomplete. Verify tag removal is intentional.
SCHEMA-CLONE🟡 mediumSchema cloned from existing schema. Verify access controls are appropriate for the clone.

Database Operations (DB-xxx)

Rule IDRiskDescription
DB-CLONE🟡 mediumDatabase cloned from existing database. Verify access controls are appropriate for the clone.
DB-NAME-CHG🟡 mediumDatabase renamed. Verify all references to the old name are updated.
DB-PROPS-CHG🟡 mediumDatabase properties modified. Configuration change may affect behavior.
DB-TAG-ADD🟢 lowDatabase tag assigned. Governance metadata updated.
DB-TAG-RMV🟡 mediumDatabase tag removed. Governance metadata may be incomplete. Verify tag removal is intentional.
DB-DROP🔴 criticalDROP DATABASE detected. All schemas, tables, and data within the database will be permanently deleted.

Masking Policies (MASK-xxx)

Rule IDRiskDescription
MASK-NEW🟢 lowMasking Policy created. Positive governance signal.
MASK-ALLOW-ALL🔴 criticalMasking Policy body passes through the original value without masking. Policy is effectively a no-op and sensitive data may be exposed.
MASK-BODY-CHG🔴 criticalMasking Policy logic changed. Data protection logic modified.
MASK-NAME-CHG🟠 highMasking Policy renamed. Dependent columns may be affected.
MASK-TAG-RMV🟡 mediumTag removed from Masking Policy. Governance metadata may be incomplete.
MASK-TAG-ADD🟢 lowTag added to Masking Policy. Positive governance signal.
MASK-COMMENT-ADD🟢 lowComment added to Masking Policy. Positive documentation signal.
MASK-COMMENT-RMV🟢 lowComment removed from Masking Policy. Documentation lost.
MASK-DROP🔴 criticalMasking Policy dropped. Column data protection removed. All columns using this policy will be unmasked.

Row Access Policies (RAP-xxx)

Rule IDRiskDescription
RAP-NEW🟢 lowRow Access Policy created. Ensure proper testing and documentation.
RAP-ALLOW-ALL🔴 criticalRow Access Policy predicate is always true. Policy is effectively a no-op and does not restrict row access. Applies to Snowflake, BigQuery, and PostgreSQL RLS.
RAP-BODY-CHG🔴 criticalRow Access Policy logic changed. Access control logic modified.
RAP-NAME-CHG🟠 highRow Access Policy renamed. Dependent objects may be affected.
RAP-TAG-RMV🟡 mediumTag removed from Row Access Policy. Governance metadata may be incomplete.
RAP-TAG-ADD🟢 lowTag added to Row Access Policy. Positive governance signal.
RAP-COMMENT-ADD🟢 lowComment added to Row Access Policy. Positive documentation signal.
RAP-COMMENT-RMV🟢 lowComment removed from Row Access Policy. Documentation lost.
RAP-DROP🔴 criticalRow Access Policy dropped. Row-level access controls removed. All tables using this policy will no longer filter rows.

Grant & Access (GRT-xxx)

Rule IDRiskDescription
GRT-WITH-OPT🟠 highAvoid WITH GRANT OPTION. This allows the grantee to re-grant privileges and can lead to privilege escalation.
GRT-ALL-PRIV🟠 highAvoid GRANT ALL PRIVILEGES. Use specific privilege grants to follow the principle of least privilege.
GRT-TO-PUBLIC🔴 criticalAvoid granting privileges to PUBLIC. The PUBLIC role includes all users in the account, which may expose data unintentionally.
GRT-TO-SHARE🔴 criticalData sharing boundary crossed: granting to SHARE exposes data outside the account. Verify data classification and approval.
GRT-OWNER-XFER🟠 highOwnership transfer detected. Verify approval and ensure proper access controls remain in place.
GRT-SYSROLE-EXP🔴 criticalGrant involves privileged system role (ACCOUNTADMIN, SECURITYADMIN, SYSADMIN, USERADMIN, PUBLIC). This has account-wide security implications.
GRT-ACCESS-EXP-HI🟠 highRole hierarchy change significantly expands effective access. Child role inherits 50+ privileges or affects 10+ users.
GRT-ACCESS-EXP🟡 mediumRole hierarchy change detected. Child role inherits privileges from parent role, affecting downstream roles and users.
GRT-BROAD-PRIV-HI🟠 highObject privilege grant affects 20+ users via role inheritance. Review if this access scope is intentional.
GRT-BROAD-PRIV🟡 mediumBroad privilege grant detected. Object privilege affects multiple roles and users via role inheritance.

Functions & Procedures (UDF/PROC/FUNC-xxx)

Rule IDRiskDescription
UDF-NEW🟢 lowUser-defined function created. Verify return type and usage patterns.
UDF-DYNSQL🟠 highUser-defined function executes dynamic SQL with potential injection vector. SQL injection risk if inputs are not validated. Consider parameterized queries (e.g. USING clause).
UDF-SECURE-RMV🟠 highSECURE flag removed from function. Function body is now visible to users with USAGE privilege.
UDF-EXTACC-CFG🟡 mediumFunction configured with external access integrations or secrets. Review access permissions.
FUNC-DROP🟡 mediumDROP FUNCTION detected. Function definition removed. Verify no dependencies.
PROC-NEW🟢 lowStored procedure created. Verify business logic and access controls.
PROC-DYNSQL🟠 highStored procedure executes dynamic SQL with potential injection vector. SQL injection risk if inputs are not validated. Consider parameterized queries (e.g. USING clause / sp_executesql parameters).
PROC-DROP🟡 mediumDROP PROCEDURE detected. Procedure definition removed. Verify no dependencies.
PROC-SECURE-RMV🟠 highSECURE flag removed from procedure. Procedure body is now visible to users with USAGE privilege.
PROC-EXECAS-OWNER🟡 mediumProcedure set to EXECUTE AS OWNER. RISK: If owner has elevated privileges (e.g., deploy role), this grants all callers elevated access. Consider EXECUTE AS CALLER for better privilege isolation.
PROC-EXECAS-CALLER🟢 lowProcedure set to EXECUTE AS CALLER. Runs with invoker's privileges. Safer than OWNER if procedure owner has elevated rights (e.g., deploy role). Context-dependent security.
PROC-EXECAS-RESTRICT🟠 highProcedure set to EXECUTE AS RESTRICTED CALLER. This is a significant compromise between security models - review carefully.
PROC-EXTACC-CFG🟡 mediumProcedure configured with external access integrations or secrets. Review access permissions.

Dynamic SQL (DYNSQL-xxx)

Rule IDRiskDescription
DYNSQL🟠 highDynamic SQL execution detected. SQL injection risk if input parameters are not validated. Consider parameterized queries (USING clause / sp_executesql parameters).
DYNSQL-CONCAT🔴 criticalDynamic SQL argument is built via string concatenation or FORMAT(...) interpolation. SQL injection risk — switch to a parameterized query (USING clause / sp_executesql parameter binding).
DYNSQL-NO-PARAM🟡 mediumDynamic SQL executed without parameter binding when the surface supports it (Snowflake USING, sp_executesql @params, EXECUTE … USING). Bind runtime values rather than interpolating.
DYNSQL-PARAM-CLEAN⚪ infoDynamic SQL recognized as injection-clean: every interpolated value is quoted into an identifier or literal slot it cannot break out of. Informational — verify no untrusted value reaches an unquoted slot.
DYNSQL-QUOTE-MISMATCH🔴 criticalDynamic SQL applies identifier quoting to a value placed inside a string literal. Identifier quoting (QUOTENAME / quote_ident / %I) delimits identifiers and does not escape the string-literal quote, so the value can still break out of the literal — use literal quoting (quote_literal / QUOTE / %L) or a bound parameter.
DYNSQL-LITERAL-QUOTER-IDENT🟡 mediumDynamic SQL applies literal/string quoting to a value placed in an identifier position (a table or column name). Literal quoting (quote_literal / QUOTE / %L) produces a quoted string, not an identifier, so the assembled statement is malformed or refers to the wrong object — use identifier quoting (quote_ident / QUOTENAME / %I) or validate the name against an allow-list.
DYNSQL-CROSS-SERVER🔴 criticalCross-server dynamic SQL execution detected. The remote server's auth context is exercised — validate the connection string and SQL construction.

External Tables (EXTTBL-xxx)

Rule IDRiskDescription
EXTTBL-NEW🟢 lowExternal table created. Federated data source registered for querying.

Diff Signals (DIFF-xxx)

Rule IDRiskDescription
DIFF-WRITE-WHERE-RMV🔴 criticalWrite statement became unbounded after WHERE clause was removed. May affect entire table.
DIFF-LIMIT-RMV-MULTI🔴 criticalLIMIT removed from multi-table query. Potential cartesian explosion.
DIFF-JOIN-CROSS-ADD🔴 criticalJOIN changed from {witness.baseline_kind} to CROSS. Cartesian product risk.
DIFF-SAMPLE-ADD🔴 criticalSAMPLE/TABLESAMPLE added. Query now operates on SUBSET of data.
DIFF-LIMIT-RMV🟠 highLIMIT removed. Query is now unbounded.
DIFF-WHERE-RMV🟠 highWHERE clause removed. Query is now unbounded.
DIFF-JOIN-RMV🟠 highJOIN removed. Data relationship lost.
DIFF-DISTINCT-RMV🟠 highDISTINCT removed. Query may now return duplicate rows.
DIFF-JOIN-NARROW🟠 highJOIN changed from {witness.baseline_kind} to {witness.head_kind}. May silently drop rows.
DIFF-HAVING-RMV🟠 highHAVING clause removed. Aggregate filtering lost.
DIFF-GROUPBY-COL-RMV🟠 highGROUP BY column removed. May cause aggregate explosion or changed grouping.
DIFF-QUALIFY-RMV-MULTI🟠 highQUALIFY clause removed from multi-table query with window functions. Window function filtering lost.
DIFF-AGG-FUNC-CHG🟠 highAggregate function changed from {witness.baseline} to {witness.head}. Verify business logic.
DIFF-JOIN-COND-CHG🟠 highJOIN condition changed. Data relationship logic altered.
DIFF-WHERE-COND-CHG🟠 highWHERE clause predicates changed. Query filtering logic altered.
DIFF-WIN-PART-CHG🟠 highWindow function partition changed. Results may differ.
DIFF-UNION-TO-UNIONALL🟠 highUNION changed to UNION ALL. Deduplication lost — may return duplicate rows.
DIFF-STMT-KIND-CHG🟠 highStatement type changed from {witness.baseline} to {witness.head}. Verify intent.
DIFF-PROJ-CHG🟡 mediumOutput projection slot changed from {witness.baseline_kind} to {witness.head_kind}. Verify output semantics.
DIFF-WIN-FRAME-CHG🟠 highWindow frame changed. Running totals, rankings, or cumulative calculations affected.
DIFF-WIN-PART-RMV🟠 highPARTITION BY removed from window function. Function now operates over entire result set instead of per-group.
DIFF-AGG-DISTINCT-RMV🟠 highDISTINCT removed from aggregate function. May now count/sum duplicate values.
DIFF-SUBQ-SCOPE-CHG🟠 highSubquery scope type changed (e.g., EXISTS→NOT EXISTS). Query logic inverted.
DIFF-JOIN-TYPE-CHG🟡 mediumJOIN type changed from {witness.baseline_kind} to {witness.head_kind}. Verify result-set behavior.
DIFF-QUALIFY-RMV🟡 mediumQUALIFY clause removed. Window function filtering lost.
DIFF-TBL-RMV🟡 mediumTable removed from query. Data relationship changed.
DIFF-CTE-RMV🟡 mediumCTE (Common Table Expression) removed. Query structure simplified.
DIFF-XSCHEMA-ADD🟡 mediumQuery now accesses tables across different schemas.
DIFF-LIMIT-INCR🟡 mediumLIMIT increased. More data may be returned.
DIFF-SETOP-CHG🟡 mediumSET operation changed from {witness.baseline} to {witness.head}. Query logic altered.
DIFF-WIN-RMV🟡 mediumWindow function {witness.function} removed from query. Analytic computation lost.
DIFF-AGG-DISTINCT-ADD🟡 mediumDISTINCT added to aggregate function. May reduce result values.
DIFF-AGG-ARG-CHG🟡 mediumAggregate function input changed. Verify correct column.
DIFF-GROUPBY-COL-ADD🟡 mediumGROUP BY column added. Aggregation granularity changed.
DIFF-AGG-RMV🟡 mediumAggregate function removed from query. Calculation lost.
DIFF-HAVING-CHG🟡 mediumHAVING clause filter logic changed. Aggregate filtering behavior affected.
DIFF-SETOP-ADD🟡 mediumSET operation (UNION/INTERSECT/EXCEPT) added. Query logic extended.
DIFF-SETOP-RMV🟡 mediumSET operation removed. Query logic simplified.
DIFF-SUBQ-PRED-CHG🟡 mediumPredicate changed within a subquery. Subquery filtering behavior affected.
DIFF-COL-RMV🟢 lowColumn removed from output. Downstream consumers may break.
DIFF-ORDERBY-CHG🟢 lowORDER BY clause changed. Result ordering affected.
DIFF-LIMIT-DECR🟢 lowLIMIT decreased. Query is more restrictive.
DIFF-WHERE-ADD🟢 lowWHERE clause added. Query is now bounded.
DIFF-LIMIT-ADD🟢 lowLIMIT added. Query is now bounded.
DIFF-DISTINCT-ADD🟢 lowDISTINCT added. Duplicates will be removed.
DIFF-QUALIFY-ADD🟢 lowQUALIFY clause added for window function filtering.
DIFF-HAVING-ADD🟢 lowHAVING clause added for aggregate filtering.
DIFF-WRITE-WHERE-ADD🟢 lowWrite statement became bounded with WHERE clause.
DIFF-TBL-ADD🟢 lowNew table added to query.
DIFF-JOIN-ADD🟢 lowNew JOIN added to query.
DIFF-COL-ADD🟢 lowNew column added to output.
DIFF-CTE-ADD🟢 lowCTE (Common Table Expression) added. Query structure enhanced.
DIFF-WIN-ADD🟢 lowWindow function {witness.function} added to query. Adds ranking, row numbering, or analytic computation.
DIFF-AGG-ARG-REFACTOR🟢 lowAggregate function input refactored. Likely a column extraction.
DIFF-AGG-ARG-COL-SUBST🟡 mediumColumn reference inside aggregate input was substituted. Verify the metric still measures the intended attribute.
DIFF-AGG-ARG-CONST-DRIFT🟢 lowHardcoded literal inside aggregate input changed. Verify the constant change is intentional (threshold, default, tax rate).
DIFF-AGG-ARG-OP-FLIP🟠 highBinary operator inside aggregate input changed (e.g. + to -). Output semantics altered.
DIFF-AGG-ARG-UNARY-FLIP🟠 highUnary operator inside aggregate input changed (e.g. IS NULL to IS NOT NULL). Predicate or sign inverted.
DIFF-AGG-ARG-FN-NAME-CHG🟡 mediumFunction called inside aggregate input was replaced. Verify semantic equivalence across dialects.
DIFF-AGG-ARG-FN-ARITY-CHG🟢 lowFunction arity inside aggregate input changed. Fallback chain depth or input set shifted.
DIFF-AGG-ARG-CASE-BRANCH-CHG🟡 mediumCASE branch count inside aggregate input changed. Aggregated output rules shifted.
DIFF-AGG-ARG-CASE-ELSE-ADDED🟡 mediumCASE inside aggregate input gained an ELSE clause. NULL handling now explicit; output for unmatched rows changed.
DIFF-AGG-ARG-CASE-ELSE-RMV🟡 mediumCASE inside aggregate input lost its ELSE clause. Unmatched rows now produce NULL, changing aggregate output for sparse data.
DIFF-AGG-ARG-CAST-TYPE-CHG🟡 mediumCast target type inside aggregate input changed. Precision, truncation, or representation may shift.
DIFF-AGG-ARG-SHAPE-CHG🟡 mediumExpression wrapping shape inside aggregate input changed (e.g. bare column wrapped in COALESCE/function). NULL or coercion semantics altered.
DIFF-AGG-ARG-SUBQ-CHG🟠 highScalar subquery inside aggregate input now reads a different table set. Data dependency shifted.
DIFF-AGG-ARG-FIELD-PATH-CHG🟡 mediumSemi-structured field access path inside aggregate input changed. Verify the new JSON/variant path resolves to the intended attribute.
DIFF-AGG-ADD🟢 lowNew aggregate function added to query.
DIFF-SAMPLE-RMV🟢 lowSAMPLE/TABLESAMPLE removed. Query now operates on full data.
DIFF-NULL-EXPANSION🟠 highOutput column became nullable across the change. Downstream NOT NULL consumers may break silently.
DIFF-LINEAGE-LOSS🟡 mediumOutput column lost upstream source columns. Data provenance shrunk.
DIFF-TAINT-PROPAGATION🟠 highOutput column gained sensitivity tags. Possible PII leak via new join path or new projection.
DIFF-CONSTRAINT-RELAX🟡 mediumOutput column's structural constraints were relaxed. Downstream consumers relying on the constraint may break.

Snowflake (SNW-xxx)

Rule IDRiskDescription
SNW-GRT-PRIV-ROLE🔴 criticalPrivilege escalation detected: granting privileged system role. This gives full administrative control and should require explicit approval.
SNW-STG-CRED-CHG🟠 highStorage credentials changed on stage. Verify authorization and audit trail.
SNW-STG-ENC-OFF🔴 criticalEncryption disabled on stage. This exposes data at rest to potential breaches.
SNW-STG-ENC-ON🟢 lowEncryption enabled on stage. Positive security signal.
SNW-STG-INTG-CHG🟡 mediumStorage integration changed on stage. Verify access controls.
SNW-STG-INTG-SET🟢 lowStorage integration set on stage. External storage access configured.
SNW-STG-TAG-SET🟢 lowTag set on stage. Positive governance signal for metadata tracking.
SNW-STG-TAG-RMV🟡 mediumTag removed from stage. Verify governance metadata tracking is maintained.
SNW-STG-DROP🟡 mediumDROP STAGE detected. Stage and any staged files will be removed.
SNW-EXPORT-UNBOUNDED🟠 highCOPY INTO exports data to external location without filtering. Full table contents may be exposed.
SNW-UNKNOWN🟠 highUnknown syntax detected. Cannot verify compliance for this statement. Review against latest Snowflake documentation.
SNW-PWDPOL-NEW🟡 mediumPassword Policy created. Positive security signal - password controls in place.
SNW-PWDPOL-MINLEN-CRIT🔴 criticalPassword Policy created with CRITICAL weak minimum length (<8 characters). This violates basic security standards.
SNW-PWDPOL-MINLEN-WEAK🟠 highPassword Policy created with weak minimum length (8-11 characters). CIS/CISA recommend ≥12 characters (NIST SP 800-63B requires ≥8).
SNW-PWDPOL-MINLEN-CFG🟢 lowPassword Policy minimum length configured. Positive governance signal.
SNW-PWDPOL-MAXLEN-LOW🟡 mediumPassword Policy has restrictive maximum length. Users cannot create long, complex passwords.
SNW-PWDPOL-COMPLEX-WEAK🟠 highPassword Policy created with weak complexity requirements (<2 character classes). Passwords may be easily guessable.
SNW-PWDPOL-COMPLEX-CFG🟢 lowPassword Policy complexity requirements configured. Positive governance signal.
SNW-PWDPOL-NOEXPIRY🔴 criticalPassword Policy created with NO expiration (PASSWORD_MAX_AGE_DAYS = 0). Passwords never expire.
SNW-PWDPOL-EXPIRY-LONG🟠 highPassword Policy created with long expiration (>180 days). Consider shorter expiration period.
SNW-PWDPOL-EXPIRY-STALE🟡 mediumPassword Policy has long expiration period (>=90 days). Passwords remain valid for extended periods.
SNW-PWDPOL-EXPIRY-FAIR🟢 lowPassword Policy has moderate expiration period (30-89 days). Consider tighter expiration for sensitive environments.
SNW-PWDPOL-EXPIRY-CFG🟢 lowPassword Policy expiration configured. Passwords will expire per policy.
SNW-PWDPOL-RETRIES-HIGH🔴 criticalPassword Policy created with high max retries (>10). Account brute-force risk.
SNW-PWDPOL-RETRIES-CHG🟠 highPassword Policy created with moderate max retries (6-10). Consider limiting to 5 or fewer.
SNW-PWDPOL-LOCKOUT-SHORT🟠 highPassword Policy created with short lockout time (<5 minutes). Account brute-force window too small.
SNW-PWDPOL-LOCKOUT-WEAK🟡 mediumPassword Policy has short lockout time (<5 minutes). Brute-force attacks have reduced penalty window.
SNW-PWDPOL-LOCKOUT-CFG🟢 lowPassword Policy lockout configured. Positive governance signal — brute-force protection active.
SNW-PWDPOL-NOHIST🟠 highPassword Policy created with NO history (PASSWORD_HISTORY = 0). Users can reuse passwords immediately.
SNW-PWDPOL-HIST-CFG🟢 lowPassword Policy history configured. Positive governance signal — password reuse prevented.
SNW-PWDPOL-MINLEN-CRITWEAK🔴 criticalPassword minimum length SET to CRITICAL weak value (<8). This violates basic security standards.
SNW-PWDPOL-MINLEN-WEAKEN🟠 highPassword minimum length weakened (8-11 characters). CIS/CISA recommend ≥12 characters (NIST SP 800-63B requires ≥8).
SNW-PWDPOL-EXPIRY-OFF🔴 criticalPassword expiration DISABLED (PASSWORD_MAX_AGE_DAYS = 0). Passwords never expire.
SNW-PWDPOL-EXPIRY-LONGSET🟠 highPassword expiration SET to long duration (>180 days). Consider shorter period.
SNW-PWDPOL-RETRIES-INCR🔴 criticalPassword max retries INCREASED (>10). Account brute-force risk significantly increased.
SNW-PWDPOL-LOCKOUT-CUT🟠 highPassword lockout time SHORTENED (<5 minutes). Brute-force attack window reduced too much.
SNW-PWDPOL-HIST-OFF🟠 highPassword history DISABLED (PASSWORD_HISTORY = 0). Users can reuse passwords immediately.
SNW-PWDPOL-MINLEN-UNSET🔴 criticalPassword minimum length UNSET. Reverts to default (8 characters), weakening security.
SNW-PWDPOL-EXPIRY-UNSET🔴 criticalPassword expiration UNSET. Reverts to default, may remove expiration entirely.
SNW-PWDPOL-HISTORY-UNSET🟠 highPassword history UNSET. Reverts to default (0), users can reuse passwords immediately.
SNW-PWDPOL-RETRIES-UNSET🔴 criticalPassword max retries UNSET. Reverts to default, may allow unlimited login attempts enabling brute-force attacks.
SNW-PWDPOL-LOCKOUT-UNSET🔴 criticalPassword lockout time UNSET. Reverts to default, may remove account lockout protection enabling brute-force attacks.
SNW-PWDPOL-NAME-CHG🟠 highPassword Policy renamed. This may break user/role assignments referencing this policy.
SNW-PWDPOL-TAG-ADD🟢 lowPassword Policy tag set. Positive governance signal — metadata tag added.
SNW-PWDPOL-TAG-RMV🟡 mediumPassword Policy tag removed. Governance metadata lost. Verify this is intentional.
SNW-PWDPOL-COMMENT-RMV🟢 lowComment removed from Password Policy. Documentation lost.
SNW-PWDPOL-DROP🔴 criticalPassword Policy dropped. Password strength controls removed. Verify this doesn't weaken authentication security.
SNW-SESSPOL-NEW🟢 lowSession Policy created. Positive governance signal — session timeout controls configured.
SNW-SESSPOL-IDLE-LONG🟠 highSession Policy created with long idle timeout (>24 hours). Consider shorter timeout for better security.
SNW-SESSPOL-UIIDLE-LONG🟠 highSession Policy created with long UI idle timeout (>24 hours). Consider shorter timeout for better security.
SNW-SESSPOL-IDLE-LONGSET🟠 highSession idle timeout SET to long duration (>24 hours). Consider shorter timeout for better security.
SNW-SESSPOL-UIIDLE-LONGSET🟠 highUI idle timeout SET to long duration (>24 hours). Consider shorter timeout for better security.
SNW-SESSPOL-IDLE-CHG🟡 mediumSession idle timeout modified. Review new timeout value.
SNW-SESSPOL-IDLE-UNSET🔴 criticalSession idle timeout UNSET. Sessions can remain active indefinitely. This weakens security posture significantly.
SNW-SESSPOL-UIIDLE-UNSET🔴 criticalUI idle timeout UNSET. UI sessions can remain active indefinitely. Verify this doesn't create unattended access risk.
SNW-SESSPOL-NAME-CHG🟡 mediumSession Policy renamed. Verify all roles/users referencing this policy are updated.
SNW-SESSPOL-TAG-ADD🟢 lowSession Policy tag set. Positive governance signal — metadata tag added.
SNW-SESSPOL-TAG-RMV🟡 mediumSession Policy tag removed. Governance metadata lost. Verify this is intentional.
SNW-SESSPOL-COMMENT-ADD🟢 lowComment added to Session Policy. Positive documentation signal.
SNW-SESSPOL-COMMENT-RMV🟢 lowComment removed from Session Policy. Documentation lost.
SNW-SESSPOL-DROP🔴 criticalSession Policy dropped. Session governance controls removed. All roles/users referencing this policy lose session management.
SNW-NETPOL-NEW🔴 criticalNetwork Policy created. New network access controls established.
SNW-NETPOL-IPALLOW-CFG🟢 lowNetwork Policy ALLOWED_IP_LIST configured. IP allowlist established.
SNW-NETPOL-IPBLOCK-CFG🟢 lowNetwork Policy BLOCKED_IP_LIST configured. IP blocklist established.
SNW-NETPOL-RULELIST-CFG🟡 mediumNetwork Policy ALLOWED_NETWORK_RULE_LIST configured. Network rules referenced.
SNW-NETPOL-SET🔴 criticalNetwork Policy SET operation. This replaces the entire IP/rule list. Verify authorization and review new configuration.
SNW-NETPOL-ADD🟠 highNetwork Policy ADD operation. Network rules or IPs added.
SNW-NETPOL-RMV🔴 criticalNetwork Policy REMOVE operation. Network restrictions removed.
SNW-NETPOL-NAME-CHG🟠 highNetwork Policy renamed. Dependent objects may be affected.
SNW-NETPOL-TAG-ADD🟢 lowTag added to Network Policy. Positive governance signal.
SNW-NETPOL-TAG-RMV🟡 mediumTag removed from Network Policy. Governance metadata may be incomplete.
SNW-NETPOL-COMMENT-RMV🟢 lowComment removed from Network Policy. Documentation cleared.
SNW-NETPOL-DROP🔴 criticalNetwork Policy dropped. Network access controls removed.
SNW-AUTHPOL-NEW🟠 highAuthentication Policy created. New authentication controls established.
SNW-AUTHPOL-MFA-OFF🔴 criticalAuthentication Policy created without MFA requirement. Multi-factor authentication not enforced, accounts vulnerable to credential compromise.
SNW-AUTHPOL-CHG🟠 highAuthentication Policy modified. Authentication controls changed. Review new configuration.
SNW-AUTHPOL-METHODS-CHG🔴 criticalAuthentication methods changed. Allowed authentication methods modified. Verify this is authorized.
SNW-AUTHPOL-MFA-CHG🔴 criticalMFA requirement changed. Multi-factor authentication policy modified. Verify enforcement still meets compliance requirements.
SNW-AUTHPOL-CLIENT-CHG🟠 highClient types changed. Allowed client types modified. Verify this is authorized.
SNW-AUTHPOL-SECINTG-CHG🔴 criticalSecurity integrations changed. Authentication providers modified. Verify trust relationships remain intact.
SNW-AUTHPOL-DROP🔴 criticalAuthentication Policy dropped. Authentication controls removed. Account vulnerable to credential compromise.
SNW-AUTHPOL-ON🟢 lowAuthentication policy enabled. Positive security signal.
SNW-AUTHPOL-OFF🔴 criticalAuthentication policy disabled. Identity verification suspended.
SNW-AGGPOL-NEW🟠 highAggregation Policy created. This controls minimum group sizes for aggregation queries to prevent small group disclosures. Verify MIN_GROUP_SIZE is adequate for your privacy requirements.
SNW-AGGPOL-NOCONST🔴 criticalAggregation Policy uses NO_AGGREGATION_CONSTRAINT. This removes all aggregation protections, allowing small group queries that may disclose sensitive information.
SNW-AGGPOL-GRPSZ-CRIT🔴 criticalAggregation Policy has dangerously low MIN_GROUP_SIZE (< 3). Groups smaller than 3 can easily lead to re-identification.
SNW-AGGPOL-GRPSZ-LOW🟠 highAggregation Policy has low MIN_GROUP_SIZE (3-4). While better than 1-2, groups of 3-4 still pose re-identification risks.
SNW-AGGPOL-GRPSZ-STRONG🟢 lowAggregation Policy has strong MIN_GROUP_SIZE (≥10). Good privacy protection. This significantly reduces re-identification risk.
SNW-AGGPOL-COND🟡 mediumAggregation Policy uses conditional logic (CASE expressions). Conditional policies can have different protections for different scenarios. Verify all branches have adequate MIN_GROUP_SIZE values.
SNW-AGGPOL-NOCONST-CHG🔴 criticalAggregation Policy body changed to NO_AGGREGATION_CONSTRAINT. Protection removed entirely. This exposes data to unrestricted aggregation queries.
SNW-AGGPOL-CHG🟡 mediumAggregation Policy altered. Policy modified. Review changes to ensure they maintain adequate privacy protections.
SNW-AGGPOL-NAME-CHG🟡 mediumAggregation Policy renamed. Policy name changed. Verify references to this policy are updated in dependent objects and documentation.
SNW-AGGPOL-TAG-ADD🟢 lowAggregation Policy tag set. Metadata tag added to policy. Informational only.
SNW-AGGPOL-TAG-RMV🟡 mediumAggregation Policy tag removed. Governance metadata lost. Verify this is intentional.
SNW-AGGPOL-COMMENT-ADD🟢 lowComment added to Aggregation Policy. Positive documentation signal.
SNW-AGGPOL-COMMENT-RMV🟢 lowComment removed from Aggregation Policy. Documentation lost.
SNW-AGGPOL-DROP🔴 criticalAggregation Policy dropped. Aggregation protections removed. This removes minimum group size constraints, potentially exposing sensitive data through small group aggregations.
SNW-PROJPOL-NEW🟢 lowProjection Policy created. Positive governance signal — projection controls in place.
SNW-PROJPOL-DROP🟠 highProjection Policy dropped. Projection controls removed. Verify dependent objects are updated.
SNW-PROJPOL-CHG🟡 mediumProjection Policy altered. Policy modified. Review changes.
SNW-PROJPOL-NAME-CHG🟡 mediumProjection Policy renamed. Verify references in dependent objects.
SNW-PROJPOL-ALLOWLIST🟡 mediumProjection Policy uses ALLOW => TRUE. Verify allowlist is intentional.
SNW-PROJPOL-ENFORCE-OFF🔴 criticalProjection Policy enforcement DISABLED (ENFORCEMENT => 'NULLIFY'). Constraints not enforced; data exposed.
SNW-PROJPOL-ENFORCE-ON🟢 lowProjection Policy enforcement enabled. Positive security signal.
SNW-PROJPOL-COND🟡 mediumProjection Policy uses conditional logic (CASE expressions). Verify all branches have adequate constraints.
SNW-PROJPOL-TAG-ADD🟢 lowProjection Policy tag set. Positive governance signal — metadata tag added.
SNW-PROJPOL-TAG-RMV🟡 mediumProjection Policy tag removed. Governance metadata lost.
SNW-PROJPOL-COMMENT-ADD🟢 lowComment added to Projection Policy. Positive documentation signal.
SNW-PROJPOL-COMMENT-RMV🟢 lowComment removed from Projection Policy. Documentation lost.
SNW-MASK-EXEMPT🔴 criticalMasking Policy created with EXEMPT_OTHER_POLICIES = TRUE. May bypass other data protection policies.
SNW-API-INTG-NEW🔴 criticalAPI Integration created. New external API access established. Verify endpoint security.
SNW-API-INTG-NOPFX🟡 mediumAPI Integration created or modified WITHOUT prefix restrictions. Unrestricted API access may be granted. Consider setting API_ALLOWED_PREFIXES or API_BLOCKED_PREFIXES.
SNW-API-INTG-ON🟢 lowAPI Integration enabled. Info: Integration is active.
SNW-API-INTG-OFF🟠 highAPI Integration disabled. Integration is no longer active. Verify dependent services are not impacted.
SNW-API-INTG-CREDCHG🟠 highAPI credential changed on API Integration. Authentication credential or cloud IAM reference modified. Audit trail required.
SNW-API-INTG-CREDRMV🟠 highAPI Key UNSET from API Integration. Authentication credential removed. Verify this change is intentional.
SNW-STGINTG-NEW🟠 highStorage Integration created. New external storage access established. Verify cloud IAM trust relationship.
SNW-STGINTG-NEW-OFF🟡 mediumStorage Integration created with ENABLED = FALSE. Integration not active at creation.
SNW-STGINTG-OFF🔴 criticalStorage Integration disabled. External storage access suspended.
SNW-STGINTG-ON🟢 lowStorage Integration enabled. Positive signal — integration active.
SNW-STGINTG-AWS-CHG🔴 criticalStorage Integration AWS role changed. Cloud IAM trust relationship modified. Verify authorization.
SNW-STGINTG-AZURE-CHG🔴 criticalStorage Integration Azure tenant changed. Cloud trust relationship modified. Verify authorization.
SNW-STGINTG-LOC-CHG🟠 highStorage Integration allowed locations changed. Data access scope modified.
SNW-STGINTG-BLOCKLOC-CHG🟠 highStorage Integration blocked locations changed. Data access scope modified.
SNW-STGINTG-TAG-ADD🟢 lowStorage Integration tag set. Positive governance signal — metadata tag added.
SNW-STGINTG-TAG-RMV🟡 mediumStorage Integration tag removed. Governance metadata lost. Verify this is intentional.
SNW-STGINTG-DROP🔴 criticalStorage Integration dropped. External storage access removed. All dependent stages and pipes affected.
SNW-EXTACC-NEW🟡 mediumExternal access integration created. Network egress configured.
SNW-EXTACC-DROP🟠 highExternal access integration dropped. Network egress removed.
SNW-EXTACC-OFF🟠 highExternal access integration disabled. Network egress suspended.
SNW-EXTACC-ON🟡 mediumExternal access integration enabled. Network egress activated.
SNW-EXTACC-HOSTS-CHG🔴 criticalExternal access allowed hosts changed. Network egress scope modified.
SNW-EXTACC-NETRULES-CHG🟠 highExternal access network rules changed. Verify egress restrictions.
SNW-EXTACC-SECRETS-CHG🔴 criticalExternal access allowed secrets changed. Credential access modified.
SNW-EXTACC-SECRET-RMV🟠 highExternal access secret removed from allowed list.
SNW-EXTACC-NETRULE-ADD🟡 mediumNetwork rule added to external access integration.
SNW-EXTACC-NETRULE-RMV🟠 highNetwork rule removed from external access integration.
SNW-EXTACC-COMMENT-CHG🟢 lowExternal access integration comment changed.
SNW-EXTACC-TAG-ADD🟢 lowTag added to external access integration. Positive governance.
SNW-EXTACC-TAG-RMV🟡 mediumTag removed from external access integration.
SNW-EXTACC-NAME-CHG🟠 highExternal access integration renamed. Dependent objects may break.
SNW-EXTACC-OWNER-CHG🟠 highExternal access integration ownership changed.
SNW-EXTACC-CHG🟡 mediumExternal access integration modified. Verify configuration.
SNW-NOTIFINTG-NEW🟢 lowNotification integration created. External notification configured.
SNW-NOTIFINTG-CHG🟢 lowNotification integration modified. Verify configuration.
SNW-DYNTBL-NEW🟢 lowDynamic table created. Materialized view with automatic refresh.
SNW-DYNTBL-PARSE-ERR🟡 mediumDynamic table query could not be parsed. Lineage extraction incomplete.
SNW-DYNTBL-DROP🟠 highDynamic table dropped. Materialized view and automatic refresh removed.
SNW-DYNTBL-SUSP🟢 lowDynamic table suspended. Automatic refresh paused.
SNW-DYNTBL-RESUME🟢 lowDynamic table resumed. Automatic refresh reactivated.
SNW-DYNTBL-NAME-CHG🟡 mediumDynamic table renamed. Update dependent references.
SNW-DYNTBL-SWAP🟡 mediumDynamic table swapped with another. Verify data integrity.
SNW-DYNTBL-TAG-ADD🟢 lowTag set on dynamic table. Positive governance signal for metadata tracking.
SNW-DYNTBL-TAG-RMV🟡 mediumTag removed from dynamic table. Verify governance metadata tracking is maintained.
SNW-DYNTBL-RAP-ADD🟡 mediumRow access policy applied to dynamic table. Access controls configured.
SNW-DYNTBL-RAP-RMV🟠 highRow access policy removed from dynamic table. Access controls weakened.
SNW-DYNTBL-MASK-ADD🟡 mediumMasking policy applied to dynamic table column. Data protection configured.
SNW-DYNTBL-MASK-RMV🟠 highMasking policy removed from dynamic table column. Data protection weakened.
SNW-PIPE-NEW🟢 lowPipe created. Data loading pipeline configured.
SNW-PIPE-AUTOINGEST🟡 mediumPipe created with AUTO_INGEST = TRUE. Data will be loaded automatically when files arrive in stage.
SNW-PIPE-DROP🟠 highPipe dropped. Data loading pipeline removed. Incoming data will no longer be auto-loaded.
SNW-PIPE-SET🟢 lowPipe properties modified via SET.
SNW-PIPE-TAG-SET🟢 lowTag assigned to pipe. Governance metadata applied.
SNW-PIPE-TAG-UNSET🟡 mediumTag removed from pipe. Governance metadata lost.
SNW-PIPE-REFRESH🟢 lowPipe manually refreshed. Staged files will be re-evaluated for loading.
SNW-STREAM-NEW🟢 lowStream created. CDC tracking enabled on source object.
SNW-STREAM-APPENDONLY🟢 lowStream configured with APPEND_ONLY mode. Only INSERT operations will be tracked.
SNW-STREAM-INSERTONLY🟢 lowStream configured with INSERT_ONLY mode for external table.
SNW-STREAM-DROP🟠 highStream dropped. CDC tracking removed - downstream consumers may be affected.
SNW-SCHEMA-MGDACC-NEW🟢 lowSchema created with MANAGED ACCESS. Centralized privilege management enabled - only schema owner can grant privileges.
SNW-SCHEMA-MGDACC-ON🟢 lowSchema MANAGED ACCESS enabled. Centralized privilege management now active - only schema owner can grant privileges on objects.
SNW-SCHEMA-MGDACC-OFF🟠 highSchema MANAGED ACCESS disabled. Object owners can now grant privileges. Review privilege grants for compliance.
SNW-SCHEMA-RETENTION-CHG🟠 highSchema data retention period changed. Time Travel and Fail-safe capabilities for all objects in schema may be affected.
SNW-SCHEMA-SWAP🟠 highSchema swapped with another schema. All objects exchanged between schemas. Verify access controls.
SNW-ROLE-PRIV-USE🔴 criticalPrivileged role should not be hardcoded in scripts. Use role grants or session variables instead.
SNW-TASK-NEW🟢 lowScheduled task created. Automated SQL execution configured.
SNW-TASK-DROP🟠 highScheduled task dropped. Automated workflow removed.
SNW-TASK-RESUME🟡 mediumTask resumed. Automated execution is now active.
SNW-TASK-SUSPEND🟢 lowTask suspended. Automated execution paused.
SNW-TASK-BODY-CHG🟡 mediumTask SQL body modified. Review the new logic for correctness.
SNW-TASK-DEP-CHG🟡 mediumTask dependency chain modified. Verify DAG execution order.
SNW-TASK-EXECAS🟠 highTask EXECUTE AS configured. Verify privilege escalation is intentional.
SNW-TASK-PARSE-ERR🟡 mediumTask body SQL could not be parsed. Lineage extraction incomplete.
SNW-TASK-OVERLAP-ALL🟠 highOVERLAP_POLICY = ALLOW_ALL_OVERLAP. Multiple instances of the entire task graph, including the root task, can run concurrently. Risk of resource contention, duplicate processing, and data races.
SNW-TASK-OVERLAP-CHILD🟡 mediumOVERLAP_POLICY = ALLOW_CHILD_OVERLAP. A new task graph instance starts while child tasks are still running. Verify child tasks are idempotent.
SNW-DB-FROM-SHARE🟠 highDatabase created from share. Data is being accessed from external provider. Verify data governance compliance.
SNW-DB-REPLICA🟡 mediumDatabase created as replica. Data is being replicated from another region/account.
SNW-DB-SWAP🟠 highDatabase swapped with another database. All objects exchanged between databases. Verify access controls.
SNW-DB-RETENTION-CHG🟠 highDatabase data retention period changed. Time Travel and Fail-safe capabilities may be affected.
SNW-DB-REPL-ON🟠 highDatabase replication enabled. Data will be replicated to other accounts/regions. Verify compliance with data residency requirements.
SNW-DB-REPL-OFF🟠 highDatabase replication disabled. Disaster recovery capabilities reduced.
SNW-DB-FAILOVER-ON🟡 mediumDatabase failover enabled. Account can be promoted as failover target.
SNW-DB-FAILOVER-OFF🟠 highDatabase failover disabled. Disaster recovery failover capability removed.
SNW-DB-FAILOVER-PROMOTE🔴 criticalDatabase promoted to primary. This is a failover event. The database is now writable and replication direction has changed.
SNW-DB-REFRESH🟡 mediumDatabase refresh initiated from primary. Local changes may be overwritten.
SNW-WH-NEW🟢 lowWarehouse created. New compute resource provisioned.
SNW-WH-LARGE🟡 mediumWarehouse created with very large size (4XL+). Significant cost impact — verify workload justifies size.
SNW-WH-SNOWPARK🟡 mediumSnowpark-optimized warehouse created. Specialized compute for ML/data engineering workloads.
SNW-WH-NO-AUTOSUSPEND🟡 mediumWarehouse auto-suspend disabled (AUTO_SUSPEND = 0). Credits will be consumed continuously.
SNW-WH-MULTICLUSTER🟢 lowMulti-cluster warehouse configured. Scaling parameters affect cost and concurrency.
SNW-WH-DROP🔴 criticalDROP WAREHOUSE detected. Compute resource permanently removed. Active queries and dependent tasks will fail.
SNW-WH-SUSPEND🟢 lowWarehouse suspended. Compute paused — no credits consumed while suspended.
SNW-WH-RESUME🟡 mediumWarehouse resumed. Compute is now active and consuming credits.
SNW-WH-ABORT🟠 highABORT ALL QUERIES on warehouse. All running queries terminated immediately.
SNW-WH-RENAME🟡 mediumWarehouse renamed. References using old name will break.
SNW-WH-SIZE-CHG🟡 mediumWarehouse size changed. Cost and performance characteristics altered.
SNW-WH-SET🟢 lowWarehouse properties modified via SET.
SNW-WH-TAG-SET🟢 lowTag assigned to warehouse. Governance metadata applied.
SNW-WH-TAG-UNSET🟡 mediumTag removed from warehouse. Governance metadata lost.

BigQuery (BQ-xxx)

Rule IDRiskDescription
BQ-SNAP-TBL-NEW🟢 lowSnapshot table created. Point-in-time clone of source table.
BQ-SNAP-TBL-DROP🟡 mediumSnapshot table dropped. Point-in-time recovery path removed for this dataset.
BQ-SEARCHIDX-NEW🟢 lowSearch index created for full-text search capabilities.
BQ-SEARCHIDX-DROP🟡 mediumSearch index dropped. Full-text search performance on this table may degrade.
BQ-VECIDX-NEW🟢 lowVector index created for ML embedding similarity search.
BQ-VECIDX-CHG🟢 lowVector index modified (e.g., REBUILD). Validate embedding search quality/performance baselines.
BQ-VECIDX-DROP🟡 mediumVector index dropped. ML embedding search performance on this table may degrade.
BQ-MODEL-NEW🟢 lowBigQuery ML model created. Training data pipeline established.
BQ-MODEL-DROP🟡 mediumBigQuery ML model dropped. Dependent prediction queries will fail.
BQ-MODEL-CHG🟢 lowBigQuery ML model options modified.
BQ-MODEL-EXPORT🟡 mediumBigQuery ML model exported to external storage. Model artifacts leaving BigQuery.
BQ-ASSERT-CFG🟢 lowASSERT statement present. Data quality/runtime invariant check is enforced.
BQ-ASSERT-NODESC🟢 lowASSERT statement missing descriptive message. Failures may be harder to triage in logs and runtime pipelines.
BQ-MODEL-REMOTE🟠 highBigQuery ML model uses REMOTE WITH CONNECTION. Model calls external endpoint — review connection security and data exposure.
BQ-EXPORT-UNBOUNDED🟠 highEXPORT DATA exports query results to external storage without WHERE filtering. Full table contents may be exposed.
BQ-MODEL-UNBOUNDED🟠 highBQML training query has no WHERE/filter conditions. Model may train on unintended full datasets.
BQ-EXPORT-AWS-LEAK🔴 criticalHardcoded AWS access key detected in EXPORT DATA statement. Use secure credential management instead.
BQ-EXPORT-PWD-LEAK🔴 criticalHardcoded password detected in EXPORT DATA statement. Use secure parameter passing instead.
BQ-EXPORT-APIKEY-LEAK🔴 criticalHardcoded API key or access token detected in EXPORT DATA statement. Store API keys in secure secrets managers.
BQ-EXPORT-CONNSTR-LEAK🔴 criticalConnection string with embedded credentials detected in EXPORT DATA statement. Use secure credential storage.
BQ-LOAD-AWS-LEAK🔴 criticalHardcoded AWS access key detected in LOAD DATA statement. Use secure credential management instead.
BQ-LOAD-PWD-LEAK🔴 criticalHardcoded password detected in LOAD DATA statement. Use secure parameter passing instead.
BQ-LOAD-APIKEY-LEAK🔴 criticalHardcoded API key or access token detected in LOAD DATA statement. Store API keys in secure secrets managers.
BQ-LOAD-CONNSTR-LEAK🔴 criticalConnection string with embedded credentials detected in LOAD DATA statement. Use secure credential storage.
BQ-EXTTBL-AWS-LEAK🔴 criticalHardcoded AWS access key detected in CREATE EXTERNAL TABLE/SCHEMA. Use secure credential management instead.
BQ-EXTTBL-PWD-LEAK🔴 criticalHardcoded password detected in CREATE EXTERNAL TABLE/SCHEMA. Use secure parameter passing instead.
BQ-EXTTBL-APIKEY-LEAK🔴 criticalHardcoded API key or access token detected in CREATE EXTERNAL TABLE/SCHEMA. Store API keys in secure secrets managers.
BQ-EXTTBL-CONNSTR-LEAK🔴 criticalConnection string with embedded credentials detected in CREATE EXTERNAL TABLE/SCHEMA. Use secure credential storage.
BQ-MODEL-AWS-LEAK🔴 criticalHardcoded AWS access key detected in CREATE/ALTER/EXPORT MODEL. Use secure credential management instead.
BQ-MODEL-PWD-LEAK🔴 criticalHardcoded password detected in CREATE/ALTER/EXPORT MODEL. Use secure parameter passing instead.
BQ-MODEL-APIKEY-LEAK🔴 criticalHardcoded API key or access token detected in CREATE/ALTER/EXPORT MODEL. Store API keys in secure secrets managers.
BQ-MODEL-CONNSTR-LEAK🔴 criticalConnection string with embedded credentials detected in CREATE/ALTER/EXPORT MODEL. Use secure credential storage.
BQ-LOAD-EXTSTORE🟡 mediumLOAD DATA references external cloud storage (GCS/S3/Azure). Verify source data integrity and access controls.
BQ-EXTTBL-EXTSTORE🟡 mediumCREATE EXTERNAL TABLE/SCHEMA references external cloud storage (GCS/S3/Azure). Verify source integrity and access boundaries.
BQ-MODEL-EXPORT-EXTSTORE🟡 mediumEXPORT MODEL writes artifacts to external cloud storage. Verify destination boundaries and retention controls.

PostgreSQL (PG-xxx)

Rule IDRiskDescription
PG-DOMAIN-DROP🟠 highDomain dropped. Columns using this domain type will be affected.
PG-DOMAIN-CASCADE-DROP🔴 criticalDomain dropped with CASCADE. All dependent columns, constraints, and types will be removed.
PG-DOMAIN-NAME-CHG🟢 lowDomain renamed. Verify all dependent columns and types reference the new name.
PG-DOMAIN-OWNER-CHG🟡 mediumDomain ownership changed. Verify the new owner has appropriate permissions.
PG-DOMAIN-NOTNULL-DROP🟠 highNOT NULL constraint removed from domain. Columns using this domain may now accept NULL values, potentially causing data quality issues.
PG-DOMAIN-CONSTR-DROP🟠 highConstraint removed from domain. Data validation enforced by this constraint is no longer active.
PG-DOMAIN-CONSTR-CASCADE-DROP🔴 criticalDomain constraint dropped with CASCADE. Cascading removal may affect dependent objects and columns.
PG-DOMAIN-CHG🟡 mediumDomain altered. Review changes to ensure data type semantics remain correct.
PG-RLS-CHG🟡 mediumRow-level security policy modified. Review the updated USING/WITH CHECK expressions to ensure data access remains correctly restricted.
PG-RLS-NAME-CHG🟢 lowRow-level security policy renamed. Verify dependent references are updated.
PG-RLS-DROP🔴 criticalRow-level security policy dropped. Row-level data protection removed. All rows may become visible to users who were previously restricted.
PG-RLS-CASCADE-DROP🔴 criticalRow-level security policy dropped with CASCADE. Cascading removal may affect dependent objects beyond this policy.
PG-RLS-PERMISSIVE🟡 mediumRLS policy created as PERMISSIVE. Multiple permissive policies are combined with OR, which may be less restrictive than intended. Consider RESTRICTIVE policies for tighter control.
PG-RLS-WEAK-CHECK🔴 criticalPostgreSQL RLS policy WITH CHECK expression is always true. Policy does not restrict write operations — any row can be inserted or updated.
PG-COPY-FROM🟡 mediumCOPY FROM imports data into a table. Verify the data source is trusted and the target table is correct.
PG-COPY-TO🟠 highCOPY TO exports data from a table. This may expose sensitive data — verify authorization and destination.
PG-COPY-PROGRAM🔴 criticalCOPY with PROGRAM executes a shell command on the server. CRITICAL SECURITY RISK: This allows arbitrary command execution with database server privileges.
PG-EXT-NEW🟠 highCREATE EXTENSION installs server-side code (C functions, operators, types). Some extensions (e.g. dblink, postgres_fdw, pg_stat_statements) grant powerful capabilities. Requires superuser or trusted extension support.
PG-EXT-CASCADE-NEW🔴 criticalCREATE EXTENSION ... CASCADE installs the extension AND all its dependencies automatically. Dependencies are installed without explicit review, increasing the attack surface.
PG-MATVIEW-REFRESH🟢 lowMaterialized view refreshed. This rebuilds the cached data from the underlying query.
PG-IDX-REBUILD🟡 mediumREINDEX rebuilds indexes. This may cause temporary performance impact and lock contention.
PG-IDX-NAME-CHG🟢 lowIndex renamed. Update any references to this index.
PG-IDX-CHG🟡 mediumIndex altered (tablespace or properties changed). Review impact on query performance.
PG-TRIG-NAME-CHG🟢 lowTrigger renamed. Update any references to this trigger.
PG-TRIG-CASCADE-DROP🔴 criticalTrigger dropped with CASCADE. Cascading removal may affect dependent objects.
PG-IDX-DROP🟢 lowDROP INDEX removes an index. May degrade query performance on dependent queries.
PG-IDX-CASCADE-DROP🟡 mediumDROP INDEX ... CASCADE removes an index and all dependent objects.
PG-EXT-DROP🟠 highDROP EXTENSION removes a PostgreSQL extension. Security extensions (pgcrypto, pg_audit) may be silently removed, weakening data protection.
PG-EXT-CASCADE-DROP🔴 criticalDROP EXTENSION ... CASCADE removes the extension AND all dependent objects. This can silently drop functions, views, and columns that depend on extension types.
PG-TRIG-OFF🔴 criticalALTER TABLE ... DISABLE TRIGGER disables a trigger. Audit triggers, referential integrity triggers, and security enforcement triggers will stop firing. This is a common attack vector.
PG-ROLE-NEW🟡 mediumCREATE ROLE/USER adds a new database principal. Review granted privileges, login capability, and role membership to prevent privilege creep.
PG-ROLE-CHG🟠 highALTER ROLE/USER modifies a database principal's attributes. Changes to privilege flags (SUPERUSER, CREATEDB, CREATEROLE, REPLICATION, LOGIN) can significantly affect security posture.
PG-ROLE-DROP🟠 highDROP ROLE/USER removes a database principal. Dependent objects (owned tables, grants) may become inaccessible. Use REASSIGN OWNED before dropping.
PG-ROLE-SET🟠 highSET ROLE or SET SESSION AUTHORIZATION changes the current session identity. This can escalate privileges or impersonate other users.
PG-SESSION-CHG🟡 mediumSET or RESET modifies session configuration (search_path, etc.). search_path changes can enable schema hijacking attacks.
PG-SESSION-SET🟢 lowSET modifies a session configuration parameter.
PG-SESSION-DISCARD🟡 mediumDISCARD resets session state (plans, sequences, temporary objects). Verify this is intentional.
PG-RULE-NEW🟠 highCREATE RULE defines a query rewrite rule. Rules silently transform queries, which can lead to unexpected behavior. Consider triggers as a more transparent alternative.
PG-RULE-CHG🟡 mediumALTER RULE modifies a PostgreSQL query rewrite rule. Rules can redirect INSERT/UPDATE/DELETE to different tables, affecting data integrity.
PG-RULE-DROP🟠 highDROP RULE removes a query rewrite rule. If the rule enforced data routing or security constraints, those protections are removed.
PG-OWNED-DROP🔴 criticalDROP OWNED removes all objects owned by the specified roles. This is a mass deletion operation that can cause significant data loss.
PG-OWNED-REASSIGN🟠 highREASSIGN OWNED transfers ownership of all objects from one role to another. Verify the target role has appropriate permissions.
PG-TBLSPC-NEW🟢 lowCREATE TABLESPACE defines a new storage location for database objects.
PG-TBLSPC-CHG🟡 mediumALTER TABLESPACE modifies storage configuration (location, options, ownership). Review impact on I/O performance and storage allocation.
PG-TBLSPC-DROP🟡 mediumDROP TABLESPACE removes a storage location. Objects in this tablespace must be relocated first.
PG-PUB-CHG🟡 mediumLogical replication publication modified. Changes affect which data is replicated to subscribers.
PG-SUB-CHG🟡 mediumLogical replication subscription modified. Changes affect data replication from the publisher.
PG-SYS-CFG-CHG🔴 criticalALTER SYSTEM modifies server-level configuration parameters. This affects all databases and users on the server. Changes take effect after reload/restart.
PG-TBL-LOCK🟠 highExplicit table lock acquired. This can cause blocking and deadlocks. Verify the lock mode is appropriate.
PG-RULE-CASCADE-DROP🟠 highDROP RULE ... CASCADE removes the rule AND all dependent objects. Cascading drops can affect data integrity constraints.
PG-SEQ-DROP🟢 lowDROP SEQUENCE removes a sequence generator. Columns using this sequence for defaults will break.
PG-SEQ-CASCADE-DROP🟡 mediumDROP SEQUENCE ... CASCADE removes the sequence and all dependent objects (columns with DEFAULT nextval, etc.).
PG-TYPE-DROP🟢 lowDROP TYPE removes a user-defined type. Columns or functions using this type will break.
PG-TYPE-CASCADE-DROP🟡 mediumDROP TYPE ... CASCADE removes the type and all dependent columns, functions, and casts.
PG-ANON-EXEC🟠 highDO $ block executes anonymous code. Cannot be tracked by name, audited, or rolled back. Review for privilege escalation, data modification, and unintended side effects.

Databricks (DBX-xxx)

Rule IDRiskDescription
DBX-GRT-CAT-ALLPRIV🔴 criticalGRANT ALL PRIVILEGES ON CATALOG detected. This grants every privilege on the entire Unity Catalog namespace — including all schemas, tables, views, and volumes within it. Use fine-grained grants (e.g., USE CATALOG, CREATE SCHEMA) instead.
DBX-GRT-CAT-MANAGE🔴 criticalGRANT MANAGE ON CATALOG detected. MANAGE provides broad administrative control over Unity Catalog objects and permissions. Verify this grant is explicitly approved.
DBX-GRT-CAT-MODIFY🔴 criticalGRANT MODIFY ON CATALOG detected. MODIFY in Databricks combines INSERT, UPDATE, and DELETE privileges on ALL current and future tables in the catalog. This is equivalent to granting full DML on every table. Use schema- or table-level grants instead.
DBX-GRT-SCHEMA-MANAGE🟠 highGRANT MANAGE ON SCHEMA detected. MANAGE allows delegated privilege administration within the schema. Ensure least-privilege scope and approval.
DBX-GRT-SCHEMA-MODIFY🟠 highGRANT MODIFY ON SCHEMA detected. MODIFY combines INSERT, UPDATE, and DELETE on all current and future tables in the schema. Verify this scope is intended.
DBX-GRT-VOL-MANAGE🟠 highGRANT MANAGE ON VOLUME detected. This enables broad administration over Unity Catalog volume access and metadata. Verify governance intent.
DBX-GRT-EXTUSE-LOC🔴 criticalGRANT EXTERNAL USE LOCATION detected. This allows temporary credential vending for external processing engines to access Unity Catalog external locations. CRITICAL data exfiltration risk — ALL PRIVILEGES intentionally excludes this privilege.
DBX-GRT-EXTUSE-SCHEMA🔴 criticalGRANT EXTERNAL USE SCHEMA detected. This allows temporary credential vending for external engines to access tables via Iceberg REST APIs. CRITICAL data exfiltration risk — ALL PRIVILEGES intentionally excludes this privilege.
DBX-GRT-EXTLOC-WRFILES🟠 highGRANT WRITE FILES detected. This allows direct writes to cloud object storage configured as an external location. Databricks recommends using WRITE VOLUME instead for governed access.
DBX-GRT-EXTLOC-RDFILES🟡 mediumGRANT READ FILES detected. This allows direct reads from cloud object storage configured as an external location. Databricks recommends using READ VOLUME instead for governed access.
DBX-GRT-CRED-CREATE🟠 highGRANT CREATE STORAGE CREDENTIAL detected. This allows the grantee to create new cloud storage credentials in the metastore — a highly privileged infrastructure operation.
DBX-GRT-EXTLOC-CREATE🟠 highGRANT CREATE EXTERNAL LOCATION detected. This allows the grantee to map new cloud storage paths into Unity Catalog — a privileged infrastructure operation.
DBX-GRT-SHARE-SETPERM🟠 highGRANT SET SHARE PERMISSION detected. Combined with USE SHARE and USE RECIPIENT, this enables the grantee to share data with external organizations via Delta Sharing. Verify data-sharing authorization.
DBX-RVK-CAT-ALLPRIV🟠 highREVOKE ALL PRIVILEGES ON CATALOG detected. This can immediately remove broad access and disrupt workloads. Verify blast radius and rollout timing.
DBX-RVK-CAT-MANAGE🟡 mediumREVOKE MANAGE ON CATALOG detected. Catalog-level administrative control is being removed from a principal. Verify this is expected and staged to avoid operational disruption.
DBX-CRED-NEW🟡 mediumStorage credential created. This grants cloud storage access (e.g., IAM role, service account) to Unity Catalog. Verify the credential is authorized and follows least-privilege principles.
DBX-CRED-OWNER-CHG🟠 highStorage credential ownership transferred. The new owner gains full control over cloud storage access. Verify this transfer is authorized.
DBX-CRED-NAME-CHG🟡 mediumStorage credential renamed. External locations referencing the old name may need to be updated.
DBX-SCHEMA-MGLOC🟡 mediumSchema created with MANAGED LOCATION. Data storage location overrides catalog/metastore default. Verify external location permissions.
DBX-SCHEMA-LOC🟢 lowSchema created with custom LOCATION. Data will be stored at specified path instead of default warehouse directory.
DBX-SCHEMA-OWNER-CHG🟠 highSchema ownership transferred via OWNER TO. New owner gains full control including DROP privileges. Verify authorization.
DBX-SCHEMA-PREDOPT-CHG🟢 lowSchema predictive optimization setting changed. This affects automatic optimization behavior for objects in the schema.
DBX-SCHEMA-COLLAT-CHG🟢 lowSchema default collation changed. New objects in the schema will use the updated collation. Existing objects are not affected.
DBX-SCHEMA-DBPROPS-CHG🟡 mediumSchema DBPROPERTIES modified. Database properties affect schema metadata and may impact behavior.
DBX-CAT-NEW🟢 lowCREATE CATALOG provisions a new Unity Catalog namespace. All schemas, tables, and other objects within will inherit its permissions and default settings.
DBX-CAT-OWNER-CHG🟠 highALTER CATALOG ... OWNER TO transfers full administrative control of the catalog. The new owner gains MANAGE permissions on all objects within. Verify the target principal is authorized.
DBX-CAT-CASCADE-DROP🔴 criticalDROP CATALOG CASCADE destroys the catalog AND all contained schemas, tables, views, and functions. This is an irreversible bulk data-loss operation.
DBX-CAT-DROP🟠 highDROP CATALOG removes a Unity Catalog namespace. The catalog must be empty unless CASCADE is specified. Verify no downstream dependencies exist.
DBX-CAT-TAG-CHG🟡 mediumCatalog-level tags modified. Tags control governance policies (masking, row filters) across all objects in the catalog. Verify tag values are intentional.
DBX-CAT-TAG-RMV🟡 mediumCatalog-level tags removed. Removing tags may disable governance policies (masking, row filtering) that depend on them.
DBX-CAT-PREDOPT-CHG🟢 lowPredictive optimization setting changed on catalog. This affects automatic maintenance operations (OPTIMIZE, VACUUM) for all tables within the catalog.
DBX-VOL-NEW🟢 lowCREATE VOLUME provisions a new Unity Catalog volume for file storage. External volumes reference cloud storage; managed volumes are fully governed by Unity Catalog.
DBX-VOL-OWNER-CHG🟠 highALTER VOLUME ... OWNER TO transfers full administrative control of the volume. The new owner gains MANAGE permissions on the volume and its contents.
DBX-VOL-DROP🟠 highDROP VOLUME removes a Unity Catalog volume. Managed volumes lose stored files after 7 days; external volumes lose only metadata. This cannot be undone.
DBX-VOL-NAME-CHG🟡 mediumALTER VOLUME ... RENAME TO changes the volume name. Existing file paths referencing /Volumes/catalog/schema/old_name will break.
DBX-VOL-TAG-CHG🟢 lowVolume-level tags modified. Tags enable governance classification and policy enforcement on the volume.
DBX-VOL-TAG-RMV🟡 mediumVolume-level tags removed. Removing tags may disable governance policies that depend on them for the volume.
DBX-EXTLOC-NEW🟡 mediumExternal location created. This maps a cloud storage path to a Unity Catalog location with a storage credential. Verify the URL and credential are authorized.
DBX-EXTLOC-URL-CHG🟡 mediumExternal location URL modified. This changes the mapped cloud storage path for the location. Verify the new URL is intended and access boundaries remain correct.
DBX-EXTLOC-CRED-CHG🟠 highExternal location storage credential changed. This alters which cloud principal accesses the storage path. Verify least-privilege access and authorization boundaries.
DBX-EXTLOC-OWNER-CHG🟠 highExternal location ownership transferred. The new owner gains administrative control over the location and its storage mapping. Verify this transfer is authorized.
DBX-EXTLOC-DROP🟠 highExternal location dropped. Unity Catalog objects relying on this location may lose access to underlying cloud storage. Verify dependency impact before dropping.
DBX-CONN-NEW🟡 mediumExternal connection created. This establishes a federated connection to an external data system (e.g., PostgreSQL, MySQL, Snowflake). Verify the connection type, host, and credentials are authorized.
DBX-CONN-DROP🟠 highExternal connection dropped. Foreign catalogs and federated queries depending on this connection will fail. Verify no active resources depend on this connection.
DBX-CONN-OWNER-CHG🟠 highExternal connection ownership transferred. The new owner gains full control over the federated connection and its credentials. Verify this transfer is authorized.
DBX-CONN-NAME-CHG🟡 mediumExternal connection renamed. Foreign catalogs and queries referencing the old connection name may need to be updated.
DBX-CONN-CHG🟡 mediumExternal connection options changed. Connection credentials (host, port, password) have been modified. Verify the new options are correct and authorized.
DBX-CRED-DROP🟠 highStorage credential dropped. External locations and tables depending on this credential will lose access. Verify no active resources depend on this credential.
DBX-FLOW-NEW🟢 lowCREATE FLOW defines a Lakeflow CDC pipeline (AUTO CDC INTO or APPLY CHANGES INTO). Verify keys, sequencing, and SCD mode align with data governance expectations.
DBX-TBL-PROPS-CHG🟡 mediumDelta table properties modified via SET TBLPROPERTIES. Properties like delta.deletedFileRetentionDuration, delta.logRetentionDuration, or delta.appendOnly control data retention, time travel, and mutability. Verify the new values are authorized and won't cause data loss.
DBX-TBL-PROPS-RMV🟠 highDelta table properties removed via UNSET TBLPROPERTIES. Removing properties like delta.deletedFileRetentionDuration or delta.appendOnly resets them to system defaults, which may reduce retention periods or re-enable mutations on append-only tables.
DBX-TBL-CLUSTER-OFF🟠 highCLUSTER BY NONE disables liquid clustering on a Delta table. Newly inserted or updated data will no longer be clustered, degrading query performance over time. OPTIMIZE will no longer recluster data. Verify this is intentional.
DBX-TBL-CLONE-SHALLOW🟡 mediumSHALLOW CLONE created. Shallow clones share underlying data files with the source table — they do not duplicate data. If the source table is VACUUM'd or dropped, the clone may become unreadable. Prefer DEEP CLONE for durable, independent copies.
DBX-TBL-OPT🟢 lowOPTIMIZE compacts small files in a Delta table. May be resource-intensive on large tables — schedule during off-peak hours.
DBX-VACUUM-ZERO🔴 criticalVACUUM RETAIN 0 HOURS. All historical data files will be permanently deleted immediately, destroying time travel capability and breaking any concurrent operations. This is irreversible data loss.
DBX-VACUUM-LOWRET🟠 highVACUUM with retention period below 7 days (168 hours). This may delete data files needed for time travel or concurrent operations, leading to data loss or query failures.
DBX-TBL-RESTORE🟠 highRESTORE reverts a Delta table to a previous version. This is a data-modifying operation that replaces the current table state with a prior snapshot — downstream consumers may see unexpected data.
DBX-MERGE-SCHEMA-EVO🟡 mediumMERGE WITH SCHEMA EVOLUTION enabled. Target Delta table schema may be automatically altered to match source columns. Validate schema-governance controls and downstream compatibility.
DBX-TBL-CACHE🟢 lowCACHE TABLE caches a table or query result in Spark's in-memory cache. This consumes cluster memory and may affect other workloads. Schedule during off-peak hours for large tables.
DBX-TBL-UNCACHE🟢 lowUNCACHE TABLE removes a table from Spark's in-memory cache. Subsequent queries will read from storage, which may increase latency.

Informational (INFO-xxx)

Rule IDRiskDescription
INFO-SNW-PIPE-ERRINT⚪ infoError integration configured on pipe. Error notifications will be sent.
INFO-UDF-SECURE-ADD⚪ infoFunction secured. Function body is now hidden from users without ownership.
INFO-PROC-SECURE-ADD⚪ infoProcedure secured. Procedure body is now hidden from users without ownership.
INFO-SNW-WH-RESMON⚪ infoResource monitor assigned to warehouse. Cost governance in place.
INFO-TBL-CLONE⚪ infoTable cloned. CLONE creates a copy of a table. In Snowflake, clones are zero-copy and share storage until modified. In Databricks, SHALLOW clones share data files while DEEP clones duplicate them.
INFO-DBX-TBL-HIST⚪ infoDESCRIBE HISTORY retrieves the provenance log for a Delta table. This is a read-only audit operation — no data is modified.
INFO-DBX-TBL-REPAIR⚪ infoREPAIR TABLE (MSCK REPAIR TABLE) updates the Hive metastore partition metadata for a partitioned table. This is a metadata maintenance operation; it does not rewrite table data.
INFO-DBX-TBL-CLUSTER-CFG⚪ infoLiquid clustering configured on Delta table. Run OPTIMIZE to apply clustering to existing data.
INFO-DBX-TBL-CACHE-LAZY⚪ infoCACHE LAZY TABLE registers a table for deferred caching — data is only cached on first access. Lower impact than eager CACHE TABLE.
INFO-Q-PRED-TEMPORAL⚪ infoTemporal predicate detected using CURRENT_DATE/CURRENT_TIMESTAMP. Results change daily, affecting cache hit rates.
INFO-MSSQL-HINT⚪ infoT-SQL table hint detected. Table hints override default locking and query plan behavior. Ensure hints are intentional and reviewed during code changes.
INFO-MSSQL-IDENTITY-INSERT-OFF⚪ infoSET IDENTITY_INSERT OFF restores normal IDENTITY column behavior. Positive signal: auto-increment protection re-enabled.
INFO-MSSQL-SET-OPTION⚪ infoT-SQL session option changed via SET. Session options (NOCOUNT, ANSI_NULLS, XACT_ABORT, etc.) affect query behavior and error handling for the current session.
INFO-MSSQL-EXTMDL-DROP🟢 lowDROP EXTERNAL MODEL removes an AI endpoint registration. Positive signal: reduces external attack surface. Verify no dependent queries rely on this model.
INFO-PG-DOMAIN-NEW⚪ infoDomain created. Positive governance signal — custom type constraints are being defined.
INFO-PG-DOMAIN-CONSTR-ADD⚪ infoConstraint added to domain. Positive governance signal — data validation is being strengthened.
INFO-PG-RLS-NEW⚪ infoRow-level security policy created. Positive governance signal — data access is being restricted at the row level.
INFO-PG-IDX-NEW⚪ infoCREATE INDEX adds an index. Positive governance signal — improves query performance.
INFO-PG-TRIG-ON⚪ infoALTER TABLE ... ENABLE TRIGGER restores trigger firing. Positive signal: security/audit enforcement re-activated.
INFO-PG-SEQ-NEW⚪ infoCREATE SEQUENCE defines a new sequence generator.
INFO-PG-SEQ-CHG⚪ infoALTER SEQUENCE modifies a sequence generator. Changes to INCREMENT, RESTART, or ownership may affect dependent tables.
INFO-PG-TYPE-NEW⚪ infoCREATE TYPE defines a new composite, enum, or range type.
INFO-PG-TYPE-CHG⚪ infoALTER TYPE modifies a user-defined type (add/rename values, change owner, etc.).
INFO-DB-NEW⚪ infoDatabase created. New database provisioned.
INFO-SCHEMA-NEW⚪ infoSchema created. New schema provisioned.
INFO-TBL-UNDROP⚪ infoTable recovered using UNDROP. Previously dropped table has been restored.
INFO-TYPE-UNDROP⚪ infoUNDROP TYPE recovers a previously dropped user-defined type from Snowflake Time Travel.
INFO-DB-UNDROP⚪ infoDatabase recovered using UNDROP. Previously dropped database has been restored.
INFO-SCHEMA-UNDROP⚪ infoSchema recovered using UNDROP. Previously dropped schema has been restored.
INFO-PG-MAINT-VACUUM⚪ infoVACUUM reclaims storage and updates statistics. Routine maintenance operation.
INFO-PG-MAINT-ANALYZE⚪ infoANALYZE updates table statistics for the query planner. Routine maintenance operation.
INFO-PG-MAINT-CLUSTER⚪ infoCLUSTER reorders table data according to an index. May cause brief lock on the table.
INFO-PG-NOTIFY-SUB⚪ infoLISTEN subscribes to a notification channel.
INFO-PG-NOTIFY-SEND⚪ infoNOTIFY sends a notification on a channel.
INFO-PG-NOTIFY-UNSUB⚪ infoUNLISTEN unsubscribes from a notification channel.
INFO-PG-AGG-NEW⚪ infoCREATE AGGREGATE defines a new aggregate function.
INFO-PG-OP-NEW⚪ infoCREATE OPERATOR defines a new operator.
INFO-COMMENT-CHG⚪ infoCOMMENT ON modifies object metadata. Positive governance signal — improves documentation.
INFO-DBX-CAT-COMMENT-CHG⚪ infoCOMMENT ON CATALOG modifies Unity Catalog metadata. Positive governance signal — improves catalog documentation and discoverability.
INFO-DBX-VOL-COMMENT-CHG⚪ infoCOMMENT ON VOLUME modifies Unity Catalog volume metadata. Positive governance signal — improves storage documentation.
INFO-DBX-CONN-COMMENT-CHG⚪ infoCOMMENT ON CONNECTION modifies Unity Catalog connection metadata. Positive governance signal — documents external data source purpose and ownership.
INFO-MSSQL-EXEC-PROC⚪ infoStored procedure executed via EXEC. Audit trail: verify the procedure exists and caller has EXECUTE permission.
INFO-MSSQL-VECIDX-NEW⚪ infoCREATE VECTOR INDEX adds a DiskANN vector similarity index. This enables approximate nearest-neighbor search on embedding columns. Review: metric type (cosine/dot/euclidean), MAXDOP setting, and storage impact on the target filegroup.

Other

Rule IDRiskDescription
PRIV-ON-FUTURE🟡 mediumON FUTURE grant expands to objects not yet created.
MSSQL-OPENROWSET-INLINE-CRED🔴 criticalOPENROWSET called with an inline connection string containing credentials. T-SQL OPENROWSET('provider', 'Server=...;PWD=...', ...) exposes the password in the SQL text and reaches an arbitrary external server. Use a linked-server with stored credentials, or a SQL Server credential object, not inline connection strings.
RS-DIST-ALL🟡 mediumDISTSTYLE ALL replicates the entire table to every compute node. Storage and load cost scale with cluster size; it is intended only for small, slowly-changing dimension tables. Verify the table is small enough to justify full replication.
RS-BACKUP-NO🟠 highBACKUP NO excludes this table from automated and manual cluster snapshots. Its data is NOT recoverable from a snapshot restore. Confirm the table is genuinely transient (e.g. staging/scratch) before disabling backups.
RS-SORTKEY-INTERLEAVED⚪ infoINTERLEAVED SORTKEY weights every sort column equally but carries higher VACUUM REINDEX maintenance cost and degrades as the table grows. Prefer COMPOUND SORTKEY unless queries filter on many sort columns independently.
RS-DATASHARE-NEW🟢 lowDatashare created (Redshift cross-account / cross-cluster data-sharing object). Objects added to it become queryable by consumer namespaces or AWS accounts; review what gets shared.
RS-DATASHARE-PUBLIC🔴 criticalDatashare set PUBLICACCESSIBLE TRUE — its objects are shareable with ANY AWS account, not just authorized consumer namespaces. This is a broad cross-account data-exposure surface. Confirm public accessibility is intended.
RS-DATASHARE-OBJ-ADD🟢 lowObject added to a datashare — it becomes queryable by the datashare's consumer accounts/namespaces. Verify the table or schema is authorized for cross-account sharing.
RS-DATASHARE-INCLUDENEW🟡 mediumDatashare set to auto-include newly created objects (INCLUDENEW) for a schema — future tables/views are shared with consumers automatically, with no per-object review. Verify implicit sharing of future objects is intended.
CAT-TBL-UNKNOWN🟡 mediumQuery references a table that is not present in the attached catalog. The table may be misspelled, dropped, or in a schema/database the catalog snapshot does not cover.
CAT-COL-UNKNOWN🟡 mediumQuery references a column that is not declared on its table per the attached catalog. The column may be misspelled, dropped, or added in a schema the catalog snapshot does not cover.
CAT-COL-AMBIGUOUS🟡 mediumQuery contains an unqualified column reference that resolves to two or more in-scope tables per the attached catalog. Qualify the column with its source table to avoid surprising binding behavior.
MSSQL-HINT-DIRTYREAD🟠 highTable hint NOLOCK or READUNCOMMITTED allows reading uncommitted data. Queries may return phantom rows, partially-written rows, or miss rows entirely. This is NOT a free performance optimization.
MSSQL-HINT-XLOCK🟡 mediumTable hint TABLOCKX or XLOCK requests exclusive locks, blocking all concurrent readers and writers. This can cause severe contention and deadlocks in production workloads.
MSSQL-HINT-INDEX🟡 mediumINDEX hint forces a specific index, overriding the query optimizer. The forced index may become stale as data distribution changes, or may be dropped/renamed, causing query failures.
MSSQL-HINT-FORCESCAN🟡 mediumFORCESCAN forces a full table or index scan, bypassing index seeks. Unless intentional for analytics workloads, this typically degrades performance on large tables.
MSSQL-HINT-FORCESEEK🟢 lowFORCESEEK forces the optimizer to use an index seek. While generally safe, this overrides the optimizer's cost-based decision and may degrade performance when a scan would be more efficient.
MSSQL-BULK-INSERT🟡 mediumBULK INSERT loading data from external file. External file access requires ADMINISTER BULK OPERATIONS permission. Verify file path, format options, and data validation.
MSSQL-EXTMDL-NEW🟠 highCREATE EXTERNAL MODEL registers an external AI endpoint (e.g., Azure OpenAI). Data sent to this model leaves the SQL Server boundary. Review: endpoint URL, credential scope, and data classification of columns that will be embedded or sent for inference.
MSSQL-EXTMDL-RMT🟠 highExternal AI model establishes a remote connection to an external service. Verify the endpoint URL is trusted, the credential has minimal required scope, and network egress rules permit this traffic.
MSSQL-EXTMDL-CHG🟡 mediumALTER EXTERNAL MODEL modifies an AI endpoint configuration. This could change the target service URL, credentials, or model name. Verify the new configuration doesn't expand data exposure.
MSSQL-LOGIN-NEW🟠 highCREATE LOGIN adds a new server-level authentication principal. This grants the ability to connect to the SQL Server instance. Review: authentication method (password, certificate, Windows, or external provider), password policy, and intended access scope.
MSSQL-USER-NEW🟠 highCREATE USER adds a new database-level authorization principal. This user can be granted permissions on database objects. Review: whether the user maps to a login (FOR LOGIN), is contained (WITH PASSWORD), or has no login (WITHOUT LOGIN for service accounts).
MSSQL-IDENTITY-INSERT-ON🟠 highSET IDENTITY_INSERT ON allows explicit values in IDENTITY columns, bypassing auto-increment. This can cause key collisions, break referential integrity, and indicates manual data manipulation. Ensure this is intentional and temporary.
MSSQL-LOGIN-EXT🟠 highCREATE LOGIN FROM EXTERNAL PROVIDER configures authentication via an external identity provider (e.g., Microsoft Entra ID). Verify: the OBJECT_ID maps to the correct external identity, the TYPE (E=user, X=group/app) is intentional, and the external provider trust relationship is established.
MSSQL-USER-EXT🟠 highCREATE USER FROM EXTERNAL PROVIDER maps a database user to an external identity (Microsoft Entra ID). Verify: the OBJECT_ID matches the intended external principal, and the external provider configuration is correct.
SPECTRUM-EXTDATA-NEW⚪ infoRedshift Spectrum external schema registers an external data source (Glue Data Catalog / Hive Metastore / federated database). Data queried through it crosses the cluster boundary; verify the IAM role is least-privilege and the external database/location is authorized.
TRIG-CHG🟡 mediumTrigger altered. Review the updated trigger configuration.
TRIG-DROP🟠 highTrigger dropped. Automated logic previously enforced by this trigger will no longer execute. Verify data integrity.
TRIG-NEW🟡 mediumTrigger created. Triggers execute automatically and can have significant performance and security implications. Review the trigger function.
MSSQL-XP-CMDSHELL🔴 criticalEXEC xp_cmdshell invokes the OS shell from SQL Server. xp_cmdshell runs arbitrary shell commands with the SQL Server service account's privileges (often LocalSystem or a domain account) and is a primary lateral-movement vector after a SQL injection compromise. Disable xp_cmdshell unless absolutely required; if required, restrict to sysadmin only.
MSSQL-SPCONFIG-XPCMDSHELL🔴 criticalsp_configure invoked with 'xp_cmdshell' option. This is the prerequisite to enabling xp_cmdshell at the server level. After this call + RECONFIGURE, EXEC xp_cmdshell can run OS commands. Verify intent and audit the surrounding context.
DNY-PRIV🟡 mediumDENY statement detected. Explicit privilege denial overrides GRANT and blocks access. Verify this is intentional and documented.
DNY-ALL-PRIV🟠 highDENY ALL PRIVILEGES detected. This blocks all access to the securable and overrides any existing grants.
DNY-TO-PUBLIC🔴 criticalDENY to PUBLIC detected — affects ALL database users/principals. This overrides individual grants and may require admin-level intervention to reverse.
DNY-CASCADE🟠 highDENY with CASCADE detected. This propagates the denial to all principals who received the privilege via the target principal.
DNY-AS-PRINCIPAL🟠 highDENY with AS clause detected. This executes the denial on behalf of another principal, which may indicate privilege escalation or impersonation.
SCRIPT-SILENT-HANDLER🟠 highDECLARE CONTINUE HANDLER FOR SQLEXCEPTION without RESIGNAL silently swallows all errors. This is the SQL equivalent of a bare 'except: pass' — failures will be invisible and the procedure will continue with potentially corrupt state. Add RESIGNAL to re-raise after logging, or use EXIT HANDLER instead.

Generated from builtin_rules.yaml at build time.

Need Help?

Can't find what you're looking for? Check out our GitHub or reach out to support.

GitHub IssuesEmail Support