feat(sense): add reconciliation safety controls [T-012]

2026-08-07 23:00:03 +08:00
parent 677ed732f7
commit 12857fdf32
35 changed files with 2817 additions and 124 deletions
@@ -0,0 +1,17 @@
+-- Extend the least-privilege boundary to reconciliation and orphan state.
+
+REVOKE ALL ON TABLE
+    sense.media_path_ownership,
+    sense.operational_leases,
+    sense.orphan_scan_runs,
+    sense.orphan_scan_findings,
+    sense.orphan_cleanup_actions
+FROM PUBLIC;
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE
+    sense.media_path_ownership,
+    sense.operational_leases,
+    sense.orphan_scan_runs,
+    sense.orphan_scan_findings,
+    sense.orphan_cleanup_actions
+TO sense_app;