GOV-CAT-001 — Separate system schemas from governed user data
| Field | Value |
|---|---|
| Status | Open finding; source-verified, role visibility pending |
| Severity | High |
| Affected surface | Catalog and SQL Editor discovery for information_schema and cogrion_system |
| Implementation issue | bff-api #236 |
| Code-change repository | sparqd/bff-api |
Where the problem appears
Expand authorized catalogs and inspect whether information_schema or cogrion_system receives ordinary detail, metadata, sample, history, quality, or mutation controls.
Concrete observed case
Discovery applies no reserved-schema classification. Virtual metadata and product-internal schemas can therefore enter the same browsing and governance path as user datasets.
Expected condition
Keep information_schema available only for Ranger-filtered read-only discovery and hide it from ordinary governance by default. Hide and deny direct user access to cogrion_system; product features reach it through scoped service APIs.
Cause and evidence
- The UI treats returned schema names uniformly.
- information_schema is a virtual metadata surface, not a governed dataset namespace.
- cogrion_system stores internal product state used by application features.
Why it matters
Users can attempt meaningless metadata changes against virtual objects or gain visibility into internal control data. Broad access granted as a workaround weakens least privilege.
Existing controls and workarounds
Do not tag, describe, sample, or manage system schemas. Do not grant direct cogrion_system access to repair application endpoints.
Alternatives considered
- Recommended: reserved-schema classification enforced in both UI and BFF.
- Show system schemas behind an explicit technical toggle for authorized users.
- Treat every schema uniformly — rejected because capabilities and security boundaries differ.
Component involvement
- BFF enforces reserved-resource rules even when controls are hidden.
- Oqullus presents system schemas separately or omits them.
- Ranger and service identities enforce least-privilege discovery and product access.
Reproduction and verification
Follow CAT-S018. Record the visible state, request outcome, effective identity, and recovery behavior relevant to this finding.
Resolution conditions
Close when role-based discovery, mutation denial, internal-service access, and clean-versus-upgrade policy behavior are verified and consistent.
Validation and blockers
BFF, Oqullus, Ranger, and product-service owners share the boundary. Role and audit evidence is still required.