Grants and revocation

Account roles control the product:

• Owner manages membership, authorization, support policy, billing, and deletion.
• Deployer connects Sources, runs ingestion, and manages ordinary grants.
• Auditor reads operational state and Activity only.

A role is not a data grant. Every normal human or agent must receive an explicit Source grant before querying that Source.

Grant shape

One grant binds one principal to one Source. query permits the governed read path; manage is a broader Source capability reserved for authorized operators. An empty dataset list means the granted Source scope; a non-empty list narrows it to those dataset UUIDs. Limits are enforced at request time:

• expiry or no scheduled expiry;
• 1–10,000 returned rows;
• 1–268,435,456 estimated input bytes;
• 1–60 queries per minute.

Account concurrency, query-budget, and platform limits still apply. A grant can narrow but never expand those controls.

Future Sources and datasets

New Sources are never added to ordinary grants automatically. Dataset additions inside an already granted whole-Source scope become visible after catalogue and schema policy accept them. If that is too broad, use an explicit dataset allowlist.

The only future-Source wildcard is the visible Combined support access policy. It applies only to active members of Combined's internal WorkOS organization who hold the configured FDE role, and every use is audited.

Authorization decision order

For each request Combined authenticates the principal, resolves Account membership and role, loads non-revoked/non-expired grants, resolves the referenced Sources and datasets, applies the strictest row/byte/rate bounds, records the starting grant version, and checks the version again before returning. A denial does not reveal hidden Source or dataset existence.

Immediate revocation

Any grant, membership, FDE policy, or principal revocation increments the Account's grant_version. Query execution records the version at start and checks again before returning. If it changed, the result is discarded and the receipt records revocation.

Revoke one grant when a principal should lose one Source. Revoke the principal credential when an agent is retired or the secret is compromised. Revoke membership when the human leaves the Account. Disable support access when the visible FDE policy is no longer appropriate.

Agent secrets are shown once. WorkOS stores and validates the credential; Combined stores only its reference, obfuscated display value, state, and timestamps.