Skip to content

Enforcement Points

An Enforcement Point is a component within the eXate architecture where security policies, masking rules, and row-level filtering are dynamically applied to data.

Rather than modifying your applications to handle data protection, eXate uses a distributed set of enforcement points to secure data at rest, in transit, or at the query boundary. This ensures consistent policy enforcement across APIs, databases, files, and applications.

Supported Enforcement Points

eXate provides multiple enforcement mechanisms tailored to different architectural layers:

graph TD
    classDef ep fill:#f9f,stroke:#333,stroke-width:1px;
    classDef client fill:#bbf,stroke:#333,stroke-width:1px;

    A[Data Consumers / Clients] --> B{Enforcement Layer}

    B -->|REST APIs & Gateways| C[API Enforcement Point]:::ep
    B -->|Database Connections| D[Database Proxy]:::ep
    B -->|Java Applications| E[JDBC Driver]:::ep
    B -->|ETL / Batch Data| F[Bulk ETL]:::ep

    C --> G[eXate Policy Engine & Vault]
    D --> G
    E --> G
    F --> G

API

Protects data flowing through RESTful interfaces and API gateways. It dynamically masks JSON request and response payloads on the fly according to user entitlements.

Bulk ETL

Designed for high-throughput batch environments. It processes flat files, databases, and structured data streams during ETL (Extract, Transform, Load) pipelines to apply consistent classifications and PETs at scale.

Database Proxy

Acts as a transparent security middleware sitting between your applications and database engines. It inspects and rewrites SQL queries, applies Row-Level Security (RLS), and masks returned result sets dynamically.

JDBC

A client-side security driver that integrates seamlessly into any Java-based application. By wrapping standard JDBC connections, it enforces security controls natively without requiring code changes to the underlying application.

Centralised Governance, Distributed Enforcement

All enforcement points pull their security policies, attribute classifications, and cryptographic keys from the centralised eXate Portal and Vault, but enforce them locally to ensure minimal latency and high availability.