milvus-io/milvus • PR #53911Score: 9/10
feat: [RLS6] enforce row-level security for bulk import
Language: Go+8775 -6465feature
concepts demonstrated
Row-level security enforcementAuthorization and permission checksData validation before database writeState persistence across distributed components
The Issue & Context
Previously, bulk import operations in Milvus did not enforce row-level security, potentially allowing unauthorized data to be imported and bypassing access controls.
Root Cause Analysis
The bulk import process lacked integration with the row-level security (RLS) system, missing authorization checks and validation of imported rows against security policies.
Solution Strategy & Architectural Pattern
The change authorizes import options at the Proxy level, persists a trusted snapshot of the applicable security policies with each import job, and validates each imported row against these policies before writing to storage.
Key Takeaway for Contributors
Integrating security checks directly into bulk data operations is critical to maintaining consistent enforcement of access controls and preventing unauthorized data ingestion.