Discover and propose Db2 authorization repairs

Proprietary

Discover direct Db2 UPDATE and singleton SELECT statements under reusable identity, resource and result contracts. Derive caller and schema paths, program identities, SQL locations and COPY snapshots. Propose complete allow guards or current identity copies using the existing end-to-end authorization proofs. Require complete current resource keys, column permissions and independently approved enforced schemas. Relocate each SQL statement by syntax identity after earlier insertions and recheck the complete authorization chain on changed source. Conflicting policies, missing schemas and unresolved proofs remain unchanged. No source paths, program IDs or statement lines are required. Provider trust, interface semantics, table binding and repair approval remain explicit. Application team review remains required.

io.moderne.mainframe.security.ProposeDb2AuthorizationRepairs

Optional

Strict JSON with version 1 and a rules array. Each rule supplies id, operation, remediation, table, schemaSha256, authorizationContract, contractSource, approvedExit, prohibitedSources and identityCopyContractSource. operation is UPDATE or SELECT. remediation is ALLOW_GUARD or CURRENT_IDENTITY. The nested authorizationContract is the complete version 1 contract for that SQL operation. ALLOW_GUARD requires approvedExit and empty identity fields. CURRENT_IDENTITY requires prohibitedSources and identityCopyContractSource with an empty approvedExit. Approve these semantics for every matching operation on the table. Schema fingerprints identify independently approved complete DDL. Omit policies to inventory candidates without edits.

mod run . --recipe=io.moderne.mainframe.security.ProposeDb2AuthorizationRepairs

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.