See who can see what — before you change it.

What it does

Every organization enforces data-access rules — mask this PII, let EU support see only EU rows, keep this dataset two years — through a patchwork of per-database grants nobody can fully reason about. Change one, and you find out what you exposed after it ships.

Vejigante is Terraform-style plan/diff for data access policy. You declare the rules once, in version-controlled YAML — data classes, who sees what, the masking transforms, retention and residency constraints. Then veji plan shows you the effective-access diff before anything changes: “this policy newly masks 14 columns, newly exposes 2 to analytics, and conflicts with retention rule R-7.” When you’re ready, veji apply compiles those rules down to your database’s own enforcement — Postgres row-level security and masking views today, Snowflake policies next — running at native speed with nothing in the query path.

And every decision is explainable. Point Veji at a cell in the access matrix and it traces why: this column is classified email, matched by this policy, under this rule, compiled to this view. No black box, no “trust us.”

It’s useful before you let it change anything. Run it read-only against your existing grants and it shows you the access mess you already have — then you decide whether to let it enforce.

The approach

• Plan before apply. The effective-access diff is the product. You see who gains and loses access — per column, per role — before a single grant changes.
• Compile to native, never proxy. Rules become Postgres RLS, security-barrier views, and grants (Snowflake masking policies next). Enforcement runs in your database at full speed; Veji is never in the query path.
• Every cell explains itself. Classification → policy → rule → compiled object, traceable for any person and column. Conflicts are surfaced, never silently guessed — most-restrictive-wins, and ambiguity is an error you resolve.
• Open source, self-hosted, honest about limits. A single CLI you run in your own environment. Where it can only attest configuration (residency), it says so.

Free, self-hosted, Apache-2.0 core; paid support, policy packs, and managed hosting.

Get in touch