Snapshot 224587

Document

Security page

URL

https://docs.puppygraph.com/security/

Fetched

2026-11-06 06:20:11 UTC

HTTP status

200

Content type

text/html; charset=utf-8

Fetch mode

static

Size

113736 bytes

SHA-256 (raw)

445e484bdb2eaa6cfc9d275d6a67217813039fda07240dce3536f8f7e8f50a43

SHA-256 (normalized text)

c8b903be8ea5f3a643d75748cd72597ff5cf6114921e3fd07fc39df49a23d663

Normalized text

Scripts and page chrome removed; this is what change detection compares.

Skip to content
Security
PuppyGraph layers three independent access controls. Use them in combination as needed:
OAuth / OIDC Single Sign-On. Who you are. Users authenticate through your identity provider (Okta, Auth0, Azure AD, Google Workspace, Keycloak, etc.); PuppyGraph receives and verifies the ID token.
Role-Based Access Control. What you can do. Each user is assigned one of five built-in roles. Permissions are enforced at every entry point: REST, Bolt, and Gremlin.
Row-Level Security. What you can see. Per-user predicates from an entitlement table are injected into every source-table scan, so the same Cypher query returns different rows for different users.
A request flows through them in that order. The IdP says who the user is, RBAC decides whether they may execute the operation at all, and RLS narrows the result set to the rows that user is entitled to see.