Database-Level End User Authorization (DB-EUA)

Abstract

Application servers are traditionally the policy enforcement point for databases. In that model, the database cannot verify the end user’s identity or intent for each operation; it can only trust whatever context the application supplies. This creates systemic exposure to server compromise, confused-deputy problems, and weak provenance. DB-EUA moves verifiable authorization into the data path: every create/read/update/delete (CRUD) is accompanied by a user-authenticated, cryptographically verifiable token that the database (or a hardened database proxy) validates and binds to the session executing the SQL. The result is a tamper-evident, user-attributable audit trail and strong least-privilege enforcement at the DB layer—aligned with Zero Trust principles and regulatory accountability requirements.

We present:

• A precise threat model and trust assumptions.
• A two-token architecture (server channel token + per-user operation token).
• A reference implementation blueprint for PostgreSQL Row-Level Security (RLS) with a wire-protocol proxy.
• Hardening guidance (key management, mTLS, channel binding, log hygiene).
• Compliance mappings (HIPAA, SOX, GDPR, CCPA) and a summary matrix.

A practical vendor roadmap (DB engines, cloud DBs, gateway/proxy vendors, backend platforms).