It is never entirely obvious where this kind of user/row level security should be placed. Personally I don't like using frameworks with complicated authorisati

It is never entirely obvious where this kind of user/row level security should be placed. Personally I don't like using frameworks with complicated authorisation systems that I don't understand. I don't think it makes sense to use that kind of system for a hand written SQL heavy project which is what this API is undoubtly aimed at. I would rather integrate user validation into normal queries, or have it handeled at the edge with an application firewall along with other kinds of input validation. You could always do something like this... INSERT INTO test select %(inputdata) where %(cookie) = hmac(%(userid), 'serverkey','sha256' ) and char_length(%(inputdata)) < 1000