Skip to main content
Written as commitments about outcomes, not dates.

​
Next

Webhook and Slack approval

A signed outbound webhook on every proposal, carrying the masked preview. In Slack, approve and reject buttons verified against the signing secret, with each Slack user mapped to a named reviewer so the audit chain records who decided.

Re-preview a stale change

A change refused as stale is previewed again and re-offered, instead of being handed back to the agent to propose from scratch.

Durable proposals

A pending approval survives a gateway restart, so an async proposal is not lost with the process.

​
After that

  • Relationship scoping — scope a child table through its parent, so a table with no tenant column of its own can be granted safely.
  • Native row-level security as a second layer beneath governed relations, so scoping holds even for a connection that bypasses Warden.
  • Native MongoDB per-lease principals, so gateway-enforced identity becomes engine-enforced.
  • Native Neo4j per-lease principals on Enterprise, backed by its RBAC.
  • MySQL, designed for and not built.
  • A connector plugin SDK, so an internal or unusual datastore can be governed without waiting for us.

​
Later

  • A control plane: RBAC, SSO/SCIM, signed policy bundles, and a hosted console — built once the API stops moving.
  • Official SDKs for Python and TypeScript. See SDKs.
  • Signed and notarised releases, with provenance attestation.
  • Audit shipped to append-only storage, which is what turns tamper-evident into something an attacker with file access cannot quietly undo.

​
Not promised

  • Windows binaries. The parser is cgo, and no one has asked.
  • A library you import. Not an oversight — the reason is the product.
  • Protection against a compromised gateway. Warden holds the credentials; if the gateway host is owned, so is the database. Run it as least-privilege and keep the audit chain somewhere else.
  • Protection against a database superuser. Anyone who can connect directly is outside Warden’s remit, which is why native guarantees are worth more than enforced ones where an engine offers them.

​
How to read this page

A feature is described here as planned only if it is not built. Everything the rest of this documentation describes in the present tense exists today and is exercised by the test suite or the certification harness. Where a page needs to mention something unbuilt, it says so in a warning, inline — the intent is that you never have to come here to find out whether something is real.