Governed reads
The defining idea of the data platform is that governance is part of the query, not a wrapper around it. Row filters and column masks are pushed down into query execution; the result carries a classification; the read is captured as lineage and attributed a cost. None of that is bolted on afterward, and none of it can be skipped by reaching the engine a different way.
In-engine, not in-front-of
Many platforms mediate policy through a separate catalog or proxy service. If a caller can reach the engine directly, the policy is gone. System9 pushes row filters (predicate pushdown) and column masks (projection pushdown) into the engine's own execution, so a query returns exactly the rows and columns the caller is entitled to, and there is no second door that returns more.
This is the platform's clearest architectural differentiator in the data plane. The Data Governance topic covers the enforcement plane in full; this page is the concept it rests on.
What attaches to a read
| Attachment | What it means |
|---|---|
| Classification | A result carries a classification derived from the assets it read, so downstream handling knows the sensitivity of what it holds. |
| Row filters | Predicates that limit which rows a caller sees, compiled into the plan. |
| Column masks | Projections that redact or transform sensitive columns, compiled into the plan: including customer-authored functions bound as masks. |
| Lineage | The read is captured against a lineage and provenance record, so "where did this come from" is answerable after the fact. |
| Cost | Every execution is metered and attributable, so consumption is accountable rather than invisible. |
The same rule everywhere data is served
Because the control lives in execution, it holds across every serving face, the query gateways, the open sharing protocols, and the Data Exchange marketplace. And it holds in the other direction too: one revoke on the canonical governance edge stops serving at every face. See the authoritative deny.
Open interfaces, one governance model
Governed reads reach external tools over open interfaces, the PostgreSQL wire protocol, Arrow Flight SQL, and GraphQL, so existing BI and analytics tools connect with no proprietary driver and no vendor SDK, and every execution stays attributable, sandboxed, cost-metered, and classification-aware.
Across the deployment matrix
- Single-cell and multi-cell: the plan is compiled by the local engine, so a cross-cell query is governed the same way a local one is.
- Sovereign / air-gapped: enforcement needs no external policy service; the read is governed by the engine on the box.
- Cloud-enabled: identical behavior, with external tools connecting over the same open interfaces.