Every protection labelled with who actually provides it — and a connection that refuses to start when the engine cannot deliver.
Databases differ in what they can enforce. Some scope records natively; some cannot. Some preview a change exactly; some can only estimate. A tool that hides this is selling governance theatre.So every guarantee carries a level naming who provides it:
Level
Meaning
native
The engine enforces it. It holds even if Warden were bypassed entirely
enforced
Warden enforces it, by rewriting the request before the engine sees it
advisory
Observed and recorded, but not prevented
unavailable
Nobody provides it. Warden says so rather than implying otherwise
connection shop (postgresql) record scoping enforced (governed relations) field masking enforced (masked inside the statement) statement timeout native (statement_timeout, enforced by the server) attribution native (application_name and a statement comment) dry run native (transaction + rollback) fence native (xmin, re-checked FOR UPDATE at commit) per-agent identity unavailable (a real role per lease is not built yet)
The same ladder is on GET /api/v1/connections/{name} and in the operator view, in the same words, so the CLI and the console can never disagree.
You find out at setup, in a message, rather than during an incident. The repository ships a deliberately strict policy that still refuses to start today — that refusal is a test, run by hand, that the capability model is real.
A connector announcing scoping: enforced proves nothing. Two things check it:
At construction, each claim is checked against the interfaces the connector actually implements. A connector that claims scoping without the ability to apply it fails immediately.
In certification, each guarantee is exercised against a real database — scope applied to every alias, masking that survives a join, limits that truncate honestly. See wardencert.
enforced is not a lesser native; they protect against different things. native survives someone connecting around Warden with the same credentials. enforced covers engines with no such mechanism at all, and can express rules an engine’s own features cannot. Choosing between them is exactly the decision the ladder is designed to put in front of you.
{"docsConfig":{"theme":"mint","$schema":"https://mintlify.com/docs.json","name":"Warden","description":"The warden between your agents and your database. Governed data access for AI agents.","colors":{"primary":"#1F6F5C","light":"#3BA88A","dark":"#12453A"},"logo":{"light":"https://mintcdn.com/buildlab/dUwtnXQEzOkmdfAr/logo/warden-light.svg?fit=max\u0026auto=format\u0026n=dUwtnXQEzOkmdfAr\u0026q=85\u0026s=5c916c3897998322e4d8e61a772aa361","dark":"https://mintcdn.com/buildlab/dUwtnXQEzOkmdfAr/logo/warden-dark.svg?fit=max\u0026auto=format\u0026n=dUwtnXQEzOkmdfAr\u0026q=85\u0026s=1123f32f05cf0449b100aa2061be7fcb","href":"https://buildlab.mintlify.site/"},"favicon":"https://mintcdn.com/buildlab/dUwtnXQEzOkmdfAr/favicon.svg?fit=max\u0026auto=format\u0026n=dUwtnXQEzOkmdfAr\u0026q=85\u0026s=70271017cbd28ff18501d6f71f3f7667","navbar":{"links":[{"href":"https://github.com/Abhishek-Mallick/warden-dist/releases","label":"Releases"}],"primary":{"type":"button","label":"Quickstart","href":"/quickstart"}},"footer":{"socials":{"github":"https://github.com/Abhishek-Mallick/warden-dist"}},"styling":{"latex":false},"navigation":{"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"buildlab","hasAudioNarration":false,"actualSubdomain":"buildlab","customDomains":["warden.buildlab.in"],"gitSource":{"type":"github","owner":"abhishek-mallick","repo":"warden","deployBranch":"main","contentDirectory":"web","isPrivate":true,"mountPath":"","label":""},"entitlements":{"AI_CHAT":{"status":"DISABLED"},"WEB_MCP":{"status":"DISABLED"},"NARRATION":{"status":"DISABLED"}},"buildId":"6ab93fc6a3c670255a7c1586","clientVersion":"0.0.4087","searchFilterCounts":[{"language":"default","tag":"Documentation","count":25},{"language":"default","tag":"Concepts","count":12},{"language":"default","tag":"How Warden works","count":7},{"language":"default","tag":"Offerings","count":7},{"language":"default","tag":"Configure","count":5},{"language":"default","tag":"Engines","count":5},{"language":"default","tag":"Install","count":5},{"language":"default","tag":"Operate","count":5},{"language":"default","tag":"API","count":3},{"language":"default","tag":"Reference","count":3}]},"assistantConfig":{"enableAskAiButton":false,"enableStarterQuestions":false,"enableContextualStarterQuestions":false,"enableAskAiSearchBar":true},"basePath":"","hasChatPermissions":false,"hasWebMcpPermissions":false,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-rbac-roles","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"rbac-expansion","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"full-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-dual-write","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"approve-review-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-metadata","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"sso-setup-deadline-banner","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-serve","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"live-agents","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"comment-mode","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"googleFontsInlined":false},"customCss":[],"page":{"pagePath":"concepts/capability-ladder","slug":"/concepts/capability-ladder","pageMetadata":{"title":"The capability ladder","description":"Every protection labelled with who actually provides it — and a connection that refuses to start when the engine cannot deliver.","href":"/concepts/capability-ladder"},"description":{"compiledSource":"\"use strict\";\nconst {jsx: _jsx} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n p: \"p\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsx(_components.p, {\n children: \"Every protection labelled with who actually provides it — and a connection that refuses to start when the engine cannot deliver.\"\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx,jsxs:_jsxs}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){const _components={a:`a`,code:`code`,em:`em`,li:`li`,ol:`ol`,p:`p`,pre:`pre`,span:`span`,strong:`strong`,tbody:`tbody`,td:`td`,th:`th`,thead:`thead`,tr:`tr`,..._provideComponents(),...props.components},{CodeBlock,Heading,Note,Table}=_components;if(!CodeBlock)_missingMdxReference(`CodeBlock`,true);if(!Heading)_missingMdxReference(`Heading`,true);if(!Note)_missingMdxReference(`Note`,true);if(!Table)_missingMdxReference(`Table`,true);return _jsxs(_Fragment,{children:[_jsxs(_components.p,{children:[`Databases differ in what they can enforce. Some scope records natively; some cannot. Some preview a change exactly; some can only estimate. `,_jsx(_components.strong,{children:`A tool that hides this is selling governance theatre.`})]}),`\n`,_jsx(_components.p,{children:`So every guarantee carries a level naming who provides it:`}),`\n`,_jsxs(Table,{children:[_jsx(_components.thead,{children:_jsxs(_components.tr,{children:[_jsx(_components.th,{children:`Level`}),_jsx(_components.th,{children:`Meaning`})]})}),_jsxs(_components.tbody,{children:[_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`native`})}),_jsx(_components.td,{children:`The engine enforces it. It holds even if Warden were bypassed entirely`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`enforced`})}),_jsx(_components.td,{children:`Warden enforces it, by rewriting the request before the engine sees it`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`advisory`})}),_jsx(_components.td,{children:`Observed and recorded, but not prevented`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`unavailable`})}),_jsx(_components.td,{children:`Nobody provides it. Warden says so rather than implying otherwise`})]})]})]}),`\n`,_jsx(Heading,{level:`2`,id:`seen-at-startup`,children:`Seen at startup`}),`\n`,_jsx(CodeBlock,{numberOfLines:`9`,language:`text`,children:_jsx(_components.pre,{className:`shiki shiki-themes github-light-default dark-plus`,style:{backgroundColor:`#ffffff`,\"--shiki-dark-bg\":`#0B0C0E`,color:`#1f2328`,\"--shiki-dark\":`#D4D4D4`},language:`text`,children:_jsxs(_components.code,{language:`text`,numberOfLines:`9`,children:[_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` connection shop (postgresql)`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` record scoping enforced (governed relations)`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` field masking enforced (masked inside the statement)`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` statement timeout native (statement_timeout, enforced by the server)`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` attribution native (application_name and a statement comment)`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` dry run native (transaction + rollback)`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` fence native (xmin, re-checked FOR UPDATE at commit)`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` per-agent identity unavailable (a real role per lease is not built yet)`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{})})]})})}),`\n`,_jsxs(_components.p,{children:[`The same ladder is on `,_jsx(_components.code,{children:`GET /api/v1/connections/{name}`}),` and in the operator view, in the same words, so the CLI and the console can never disagree.`]}),`\n`,_jsx(Heading,{level:`2`,id:`policy-decides-what-is-good-enough`,children:`Policy decides what is good enough`}),`\n`,_jsx(CodeBlock,{filename:``,numberOfLines:`4`,language:`yaml`,children:_jsx(_components.pre,{className:`shiki shiki-themes github-light-default dark-plus`,style:{backgroundColor:`#ffffff`,\"--shiki-dark-bg\":`#0B0C0E`,color:`#1f2328`,\"--shiki-dark\":`#D4D4D4`},language:`yaml`,children:_jsxs(_components.code,{language:`yaml`,numberOfLines:`4`,children:[_jsxs(_components.span,{className:`line`,children:[_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#569CD6`},children:`require`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`:`})]}),`\n`,_jsxs(_components.span,{className:`line`,children:[_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#569CD6`},children:` scoping`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: `}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:`enforced`})]}),`\n`,_jsxs(_components.span,{className:`line`,children:[_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#569CD6`},children:` masking`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: `}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:`enforced`})]}),`\n`,_jsxs(_components.span,{className:`line`,children:[_jsx(_components.span,{style:{color:`#116329`,\"--shiki-dark\":`#569CD6`},children:` statement_timeout`}),_jsx(_components.span,{style:{color:`#1F2328`,\"--shiki-dark\":`#D4D4D4`},children:`: `}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:`native`})]}),`\n`]})})}),`\n`,_jsxs(_components.p,{children:[`Each line is a `,_jsx(_components.em,{children:`minimum`}),`. If the connection cannot reach it, the gateway `,_jsx(_components.strong,{children:`refuses to start`}),`:`]}),`\n`,_jsx(CodeBlock,{numberOfLines:`4`,language:`text`,children:_jsx(_components.pre,{className:`shiki shiki-themes github-light-default dark-plus`,style:{backgroundColor:`#ffffff`,\"--shiki-dark-bg\":`#0B0C0E`,color:`#1f2328`,\"--shiki-dark\":`#D4D4D4`},language:`text`,children:_jsxs(_components.code,{language:`text`,numberOfLines:`4`,children:[_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` ✗ per-agent identity unavailable`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` policy requires: native`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:` connection refused: 1 guarantee below required level`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{})})]})})}),`\n`,_jsx(_components.p,{children:`You find out at setup, in a message, rather than during an incident. The repository ships a deliberately strict policy that still refuses to start today — that refusal is a test, run by hand, that the capability model is real.`}),`\n`,_jsx(Heading,{level:`2`,id:`why-claims-are-verified-not-trusted`,children:`Why claims are verified, not trusted`}),`\n`,_jsxs(_components.p,{children:[`A connector announcing `,_jsx(_components.code,{children:`scoping: enforced`}),` proves nothing. Two things check it:`]}),`\n`,_jsxs(_components.ol,{children:[`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`At construction`}),`, each claim is checked against the interfaces the connector actually implements. A connector that claims scoping without the ability to apply it fails immediately.`]}),`\n`,_jsxs(_components.li,{children:[_jsx(_components.strong,{children:`In certification`}),`, each guarantee is exercised against a real database — scope applied to every alias, masking that survives a join, limits that truncate honestly. See `,_jsx(_components.a,{href:`/offerings/wardencert`,children:`wardencert`}),`.`]}),`\n`]}),`\n`,_jsx(Note,{children:_jsxs(_components.p,{children:[_jsx(_components.code,{children:`enforced`}),` is not a lesser `,_jsx(_components.code,{children:`native`}),`; they protect against different things. `,_jsx(_components.code,{children:`native`}),` survives someone connecting around Warden with the same credentials. `,_jsx(_components.code,{children:`enforced`}),` covers engines with no such mechanism at all, and can express rules an engine’s own features cannot. Choosing between them is exactly the decision the ladder is designed to put in front of you.`]})})]})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent};function _missingMdxReference(id,component){throw new Error(`Expected `+(component?`component`:`object`)+\" `\"+id+\"` to be defined: you likely forgot to import, pass, or provide it.\")}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"title":"The capability ladder","description":"Every protection labelled with who actually provides it — and a connection that refuses to start when the engine cannot deliver.","href":"/concepts/capability-ladder"}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[{"title":"Seen at startup","slug":"seen-at-startup","depth":2,"children":[]},{"title":"Policy decides what is good enough","slug":"policy-decides-what-is-good-enough","depth":2,"children":[]},{"title":"Why claims are verified, not trusted","slug":"why-claims-are-verified-not-trusted","depth":2,"children":[]}],"codeExamples":{}},"jsLinks":[],"subdomain":"buildlab","siteName":"Warden","title":"The capability ladder - Warden","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-09-23T07:57:23.476Z","originalFileLocation":"concepts/capability-ladder.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"system\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"Every protection labelled with who actually provides it — and a connection that refuses to start when the engine cannot deliver.\">\u003cmeta data-mint-head name=\"application-name\" content=\"Warden\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/buildlab/4rM301cFHivaFqFN/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/mintlify-assets/_mintlify/favicons/buildlab/4rM301cFHivaFqFN/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/buildlab/4rM301cFHivaFqFN/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/buildlab/4rM301cFHivaFqFN/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/buildlab/4rM301cFHivaFqFN/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/buildlab/4rM301cFHivaFqFN/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/buildlab/4rM301cFHivaFqFN/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/buildlab/4rM301cFHivaFqFN/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/buildlab/4rM301cFHivaFqFN/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"The capability ladder - Warden\">\u003cmeta data-mint-head property=\"og:description\" content=\"Every protection labelled with who actually provides it — and a connection that refuses to start when the engine cannot deliver.\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Warden\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://warden.buildlab.in/concepts/capability-ladder\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://buildlab.mintlify.site/_mintlify/api/og/v2?division=How+Warden+works\u0026amp;title=The+capability+ladder\u0026amp;description=Every+protection+labelled+with+who+actually+provides+it+%E2%80%94+and+a+connection+that+refuses+to+start+when+the+engine+cannot+deliver.\u0026amp;theme=e77cba30ec62e899ed9fdfd5\u0026amp;signature=278df311438ebe8a19f79a728a2b3b140728bc3e50dfefa2e6f9547cc6004eed\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"The capability ladder - Warden\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"Every protection labelled with who actually provides it — and a connection that refuses to start when the engine cannot deliver.\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://buildlab.mintlify.site/_mintlify/api/og/v2?division=How+Warden+works\u0026amp;title=The+capability+ladder\u0026amp;description=Every+protection+labelled+with+who+actually+provides+it+%E2%80%94+and+a+connection+that+refuses+to+start+when+the+engine+cannot+deliver.\u0026amp;theme=e77cba30ec62e899ed9fdfd5\u0026amp;signature=278df311438ebe8a19f79a728a2b3b140728bc3e50dfefa2e6f9547cc6004eed\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/mintlify-assets/_mintlify/favicons/buildlab/4rM301cFHivaFqFN/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Warden\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#1F6F5C\">\u003clink data-mint-head rel=\"canonical\" href=\"https://warden.buildlab.in/concepts/capability-ladder\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/concepts/capability-ladder.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://warden.buildlab.in/#organization\",\"name\":\"Warden\",\"url\":\"https://warden.buildlab.in\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintcdn.com/buildlab/dUwtnXQEzOkmdfAr/logo/warden-light.svg?fit=max\u0026auto=format\u0026n=dUwtnXQEzOkmdfAr\u0026q=85\u0026s=5c916c3897998322e4d8e61a772aa361\"}},{\"@type\":\"WebSite\",\"@id\":\"https://warden.buildlab.in#website\",\"name\":\"Warden\",\"url\":\"https://warden.buildlab.in\",\"publisher\":{\"@id\":\"https://warden.buildlab.in/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://warden.buildlab.in/concepts/capability-ladder#webpage\",\"url\":\"https://warden.buildlab.in/concepts/capability-ladder\",\"name\":\"The capability ladder\",\"description\":\"Every protection labelled with who actually provides it — and a connection that refuses to start when the engine cannot deliver.\",\"dateModified\":\"2026-09-23T07:57:23.476Z\",\"isPartOf\":{\"@id\":\"https://warden.buildlab.in#website\"},\"breadcrumb\":{\"@id\":\"https://warden.buildlab.in/concepts/capability-ladder#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://warden.buildlab.in/concepts/capability-ladder#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"How Warden works\",\"item\":\"https://warden.buildlab.in/concepts/architecture\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The capability ladder\",\"item\":\"https://warden.buildlab.in/concepts/capability-ladder\"}]},{\"@type\":[\"Article\",\"TechArticle\"],\"@id\":\"https://warden.buildlab.in/concepts/capability-ladder#article\",\"headline\":\"The capability ladder\",\"name\":\"The capability ladder\",\"description\":\"Every protection labelled with who actually provides it — and a connection that refuses to start when the engine cannot deliver.\",\"url\":\"https://warden.buildlab.in/concepts/capability-ladder\",\"mainEntityOfPage\":{\"@id\":\"https://warden.buildlab.in/concepts/capability-ladder#webpage\"},\"dateModified\":\"2026-09-23T07:57:23.476Z\",\"publisher\":{\"@id\":\"https://warden.buildlab.in/#organization\"},\"isPartOf\":{\"@id\":\"https://warden.buildlab.in#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"Warden\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","siteName":"Warden","nav":{"global":null,"tabs":[{"tab":"Documentation","pages":[{"title":"Documentation","href":""}]},{"tab":"Concepts","groups":[{"group":"How Warden works","pages":[{"title":"Architecture","description":"One path, one representation, one place the credentials live.","href":"/concepts/architecture"},{"title":"The capability ladder","href":"/concepts/capability-ladder"},{"title":"Blast radius","description":"Whether an operation is provably bounded, decided before it runs.","href":"/concepts/blast-radius"},{"title":"Previews and fences","href":"/concepts/previews-and-fences"},{"title":"Leases","href":"/concepts/leases"},{"title":"Masking","href":"/concepts/masking"},{"title":"Reliability","href":"/concepts/reliability"}]},{"group":"Engines","pages":[{"title":"PostgreSQL","href":"/engines/postgresql"},{"title":"MongoDB","href":"/engines/mongodb"},{"title":"Neo4j","href":"/engines/neo4j"},{"title":"In-memory engine","href":"/engines/memory"},{"title":"Roadmap","href":"/engines/roadmap"}]}]},{"tab":"API","pages":[{"title":"API","href":"/api/data-plane"}]}]},"basePath":"","title":"The capability ladder - Warden","buildId":"dpl_FWZhTb2vab28gFGFH4ojka6qEznQ","deploymentId":"dpl_FWZhTb2vab28gFGFH4ojka6qEznQ","dynamics":[],"chunks":[]}
