上一篇，我给同一张发票明细表加了日期、客户、地区、商品、税率和金额等类筛选条件。没有再为每个条件写一套查询接口。老实说，

但如果这张表真的接进业务程序。还有一个问题比筛选器更早：谁能看到哪些数据？

这次我仍然使用 WideWorldImporters OLTP 的发票明细。提交同一个 QueryModel、同一份 DSL、同一个日期范围，只替换调用者的权限上下文。

实际结果如下的观点是，

两次请求里没有任何一个地方由 AI 填写“我的权限区域”。生成的 SQL 结构相同，最终都被强制追加：

and d2.sales_territory =?

区别只在受信权限上下文绑定的参数：一次是 Souast一次是 New England。

使用者痛点：业务人员在页面或通过 AI 提交相同查询。却得到不一致的结果，导致决策失误、审计困难还有对网站信任度下降。

同一份 DSL 里没有权限参数

两个使用者提交的都是下面这份请求：

{
"limit":。"columns":,"slice":
}
]
}

这里的日期是业务筛选条件。使用者可以改成某个月，也可以继续增加商品、客户或金额范围。

销售区域却不是普通查询参数。

If we treat permission as a filter:

{ "field": "customer$salesTerritory","value": "Souast" }

This would be just anor slicer that callers could delete or replace—AI could also forget to add it.

The system must answer two questions separately:

• User intent: “What does user want to query?”
• System guardrail: “What is maximum data this user is allowed to see?”

权限条件在 QM 内部强制生效

A dedicated permission‑aware Query Model was created for this verification:

const invoiceLines = loadTableModel;export const queryModel = {
再看name，'wwi_oltp_invoice_lines_authorized'。model: invoiceLines,modelPermissions: {
再看mode，'resolver',resolver: => {
let territory;if {
territory = 'Souast';} else if {
territory = 'New England';} else {
return { allow: false };}
return {
从allow来看。true,rowPredicates:
};}
}
}，

The two demo tokens are disposable;in a real project resolver would receive an opaque Authorization header verified by an identity service.

使用者主动筛另一个区域会怎样？

The Souast user deliberately tries to override territory:

{
"field": "customer$salesTerritory","op": "=","value": "New England"
}

If ordinary DSL could overwrite system permissions。this request would succeed and expose unauthorized data.

The generated WHERE clause actually contains **both** conditions:

and d2.sales_territory =?and d2.sales_territory =?

The bound parameters are:

New England
Souast

The result set is empty—user‑provided filters can only narrow scope,never replace or remove system‑injected predicate.

没有身份时不是返回全量数据

• No Authorization.
• An unknown token.

Both cases are rejected with a clear error message instead of falling back to a full‑table scan:

The requested model operation is not available.

The same gate controls  describe API as well;without proper context even metadata exposure is blocked.

这和 Runtime 登录不是一回事——常见混淆点梳理

A namespace does **not** replace business‑level row rules.