Every Agent Gets an Identity

Each agent gets its own API key with configurable scope (read-only or admin). RBAC policies control which tables, columns, and rows each agent can access. Column masking redacts sensitive fields. Row-level security filters results based on agent identity. Every access is logged with the agent's identity for full auditability.

-- Create an agent-scoped API key
INSERT INTO _hatidata_keys
  (agent_id, scope, label)
VALUES (
  'agent_support_01',
  'readonly',
  'Support Agent - Tier 1'
);

-- Column masking policy
CREATE POLICY mask_ssn ON customers
  MASK COLUMN ssn
  FOR ROLE 'support_agent';

-- Row-level security
CREATE POLICY region_filter ON orders
  USING (region = current_agent_region())
  FOR ROLE 'regional_agent';