> ## Documentation Index
> Fetch the complete documentation index at: https://warden.buildlab.in/llms.txt
> Use this file to discover all available pages before exploring further.

# The capability ladder

> Every protection labelled with who actually provides it — and a connection that refuses to start when the engine cannot deliver.

Databases differ in what they can enforce. Some scope records natively; some cannot. Some preview a change exactly; some can only estimate. **A tool that hides this is selling governance theatre.**

So every guarantee carries a level naming who provides it:

| Level | Meaning |
| - | - |
| `native` | The engine enforces it. It holds even if Warden were bypassed entirely |
| `enforced` | Warden enforces it, by rewriting the request before the engine sees it |
| `advisory` | Observed and recorded, but not prevented |
| `unavailable` | Nobody provides it. Warden says so rather than implying otherwise |

## Seen at startup

```
  connection shop (postgresql)
    record scoping               enforced     (governed relations)
    field masking                enforced     (masked inside the statement)
    statement timeout            native       (statement_timeout, enforced by the server)
    attribution                  native       (application_name and a statement comment)
    dry run                      native       (transaction + rollback)
    fence                        native       (xmin, re-checked FOR UPDATE at commit)
    per-agent identity           unavailable  (a real role per lease is not built yet)
```

The same ladder is on `GET /api/v1/connections/{name}` and in the operator view, in the same words, so the CLI and the console can never disagree.

## Policy decides what is good enough

```yaml theme={null}
require:
  scoping: enforced
  masking: enforced
  statement_timeout: native
```

Each line is a *minimum*. If the connection cannot reach it, the gateway **refuses to start**:

```
  ✗ per-agent identity     unavailable
      policy requires: native
  connection refused: 1 guarantee below required level
```

You find out at setup, in a message, rather than during an incident. The repository ships a deliberately strict policy that still refuses to start today — that refusal is a test, run by hand, that the capability model is real.

## Why claims are verified, not trusted

A connector announcing `scoping: enforced` proves nothing. Two things check it:

1. **At construction**, each claim is checked against the interfaces the connector actually implements. A connector that claims scoping without the ability to apply it fails immediately.
2. **In certification**, each guarantee is exercised against a real database — scope applied to every alias, masking that survives a join, limits that truncate honestly. See [wardencert](https://warden.buildlab.in/offerings/wardencert.md).

> [!NOTE]
>
> `enforced` is not a lesser `native`; they protect against different things. `native` survives someone connecting around Warden with the same credentials. `enforced` covers engines with no such mechanism at all, and can express rules an engine's own features cannot. Choosing between them is exactly the decision the ladder is designed to put in front of you.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.