SEC-ML-003 — Define training-data identity
| Field | Value |
|---|---|
| Status | Open policy finding; source and deployment configuration verified |
| Severity | Critical until policy is approved |
| Components | sparqd/agent-based-ml-platform, sparqd/bff-api, Trino, Ranger, sparqd/platform-stacks |
| Associated issues | Not opened pending finding review |
Concrete observed case
Oqullus sends the signed-in user's request through BFF, but AutoML opens Trino connections with a platform-provisioned service-account token and principal. Catalog discovery, preview, and training reads therefore use service permissions rather than the user's SQL Editor/Ranger identity.
Expected condition
The product must declare and enforce one of two policies: delegated user access, where AutoML may read only what the user can read; or a reviewed privileged service workflow with explicit grants, consent, purpose, audit, and output controls. The UI must state which identity executes the read.
Why it matters
A user may train on data they cannot query directly, and derived artifacts may carry protected information into object storage, MLflow, notebooks, metrics, or predictions outside the original table policy.
Existing controls and workarounds
Ranger still authorizes the service principal, and the service account can be restricted to a narrow dataset. Administrators should grant it no broader access than the approved AutoML data domain until delegated identity exists.
Alternatives considered
- Recommended for self-service: token exchange or impersonation that preserves the signed-in user through Trino/Ranger and records effective identity.
- Approved service identity with dataset allowlists, purpose-based access, output classification, and complete audit.
- Trust BFF authentication alone — rejected because it does not constrain the downstream Trino principal.
Component involvement
- BFF and AutoML propagate or derive the approved effective identity.
- Trino/Ranger enforce physical access and record the principal.
- Platform stacks provisions only the required grants.
- AutoML applies the same policy to previews, training, outputs, and prediction.
Reproduction and verification
Follow ML-S003.
Resolution conditions
Close when policy is approved, the effective identity is visible and audited, deny behavior matches that policy, and derived data follows classification and retention controls.
Validation and blockers
Service-identity use is confirmed. Its current Ranger grants and the intended delegation policy were not validated.