[litkhai]

Closes #144

New lab labs/managed-rbac. One shared log table for three games (synthetic), plus each layer that decides what a Managed ClickStack user sees. Run on 2026-11-07 in two rounds:

• Round 1: ClickHouse Cloud 26.8.1.608, one Admin.
• Round 2: a trial org on 26.6.1.2455 with an Admin and a test user, side by side. hyperdx-chc 2.43.1, alerts 2.42.0.

Observed:

• ClickStack roles split screens, not rows. A tag rule hides other dashboards (in the list and by URL), but the allowed source still returns other games' rows.
• A custom role without Team read leaves the app Unauthorized.
• Roles with the API's beta row conditions are stored, are not shown in the role editor, and cannot be assigned ("Not allowed to assign a role with privileges exceeding your own").
• Search and dashboards run as a per-user JWT::… ClickHouse user with no roles, and alerts as one shared user (hdx-alert-internal / hyperdx-alert-internal).
  • A row policy on the SQL console roles has no effect on ClickStack.
  • A policy on one JWT user restricted exactly that user: alpha 7,036 rows vs the Admin's 21,109. On the round 2 service it also covered the console SQL editor.
  • TO ALL EXCEPT … filters search, tiles and alerts.
• Alerts have one scope for the whole team. The restricted user still saw every alert; when the alert user is left out of a policy, alerts fire on rows the viewer cannot search.
• Masking: String columns hold, Map keys leak through subcolumn reads, and a lambda breaks every query.

Not run: the objects-id and system ReadOnly roles on the test user, masking in round 2, and whether the JWT hash changes on a new login. Names are masked in the round 2 screens. No web key in lab.yaml (owner's call).

🤖 Generated with Claude Code