# Capability backlog: what else pg_policy should grow

**Last updated:** 2026-08-10  
Prioritized from industry gaps (MCP, Dogwood, AuthZEN, EU AI Act, multi-agent frameworks).

Legend: **P0** = next minor · **P1** = 0.2/0.3 · **P2** = 1.0+ · **Out** = non-goal

---

## Language & evaluation

| Item | Priority | Why |
| --- | --- | --- |
| `unless` clauses | P0 | Cedar parity; invert conditions without extra policies |
| `not in` / inequality on context | P0 | Real SQL-agent filters (`cost_usd < 0.05`) |
| Resource glob prefixes (`table:public.*`) | P0 | Schema allowlists |
| Temporal `formerly` / `since` / `sum` | P1 | Dogwood-class workflows (approve-then-transfer) |
| CEL or Cedar condition backend | P1 | Analyzable expressions; pgrx |
| Obligations: `require_approval`, `step_up_auth`, `redact_columns` | P1 | AuthZEN-style PEP instructions |
| Policy tests in SQL (`SELECT pg_policy.assert_deny(...)`) | P0 | CI for packs |
| Compile-to-RLS helpers | P1 | Generate `CREATE POLICY` from data-plane APL |
| Partial eval / list-allowed-tools | P1 | AuthZEN search APIs; “what can this agent do?” |

## Identity & multi-agent

| Item | Priority | Why |
| --- | --- | --- |
| `acting_for` / on-behalf-of required field | P0 | HIPAA/SOX attribution; confused-deputy |
| Agent registry table | P1 | EU AI Act Art. 9 risk register |
| Delegation tuples (lite ReBAC) | P1 | Supervisor agent may spawn worker with subset |
| Break-glass role with mandatory reason | P1 | Ops reality |
| Policy version pinned on each decision | P0 | Reproducible audits |

## Audit & compliance

| Item | Priority | Why |
| --- | --- | --- |
| Append-only decision_log (revoke UPDATE/DELETE) | P0 | Art. 12 tamper resistance (best-effort in PG) |
| HMAC / hash chain optional column | P1 | Detect silent UPDATEs by superuser |
| Retention helper (`purge_decisions_older_than`) | P0 | GDPR minimization vs legal hold |
| PII hashing guidance for context | P0 | Don’t log raw customer ids |
| Export to JSONL for SIEM | P1 | Splunk/Datadog pipelines |

## Runtime / Postgres internals

| Item | Priority | Why |
| --- | --- | --- |
| `ProcessUtility_hook` DDL firewall for agent roles | P1 | Defense if someone skips `evaluate()` |
| Statement timeout / `default_transaction_read_only` recipes | P0 | Pack, not code |
| Connection GUC `pg_policy.agent_id` | P1 | Implicit principal from session |
| pgrx evaluator | P1 | Latency at MCP QPS |
| Parallel-safe STABLE evaluate where possible | P1 | Use inside views carefully |

## Ecosystem “works for all”

| Item | Priority | Why |
| --- | --- | --- |
| Pack loader (`\i examples/packs/*.sql`) documented | **done (0.1)** | |
| Python PEP middleware | **done (0.1)** | |
| MCP reference wrapper | P0 | Drop-in for execute_sql |
| LangGraph ToolNode example | P0 | Production graph pattern |
| AuthZEN HTTP sidecar | P1 | Non-SQL PEPs |
| Terraform / Ansible install | P2 | Enterprise |
| pg_tle packaging experiment | P1 | RDS path |
| Editor TextMate/tree-sitter for APL | P2 | DX |

## Out of scope

- Replacing RLS or GRANT
- Running untrusted Python/JS as policy
- Core Postgres grammar patches
- Hosted SaaS requirement for the extension to be useful

---

## Suggested 0.2 cut

1. Pack test assertions  
2. `acting_for` in evaluate API (additive JSON)  
3. Append-only grants recipe  
4. Prefix globs  
5. `require_approval` obligation type  

Everything else can wait for pgrx without blocking adoption.