Policy-driven authorization for Apache Trino
Control who can query which catalogs, schemas, and tables in Apache Trino using the same Cerbos policies that govern your application.
Native Apache Trino support
Cerbos speaks Apache Trino's native protocol, no custom glue code required
Unified policies
The same CEL-based policies that govern your application layer extend to your infrastructure
Defense in depth
Authorization at every layer of your stack, managed from a single control plane
How Cerbos works with Apache Trino
Apache Trino provides a native integration point for Cerbos, extending policy-driven authorization to another layer of your stack without custom glue code.
Cerbos policies are written in human-readable YAML supporting RBAC, ABAC, and conditional rules. The same policies that govern your application layer now extend to Apache Trino, enforced consistently everywhere.
A unified control plane means one set of policies, one audit trail, and one management workflow, regardless of how many services and infrastructure layers your system spans.
Fine-grained data access control for Apache Trino
Apache Trino enables fast, distributed SQL queries across multiple data sources. As adoption grows within an organization, controlling who can access which data becomes critical, especially for sensitive datasets subject to compliance requirements.
Cerbos integrates directly with Apache Trino's authorization framework to provide fine-grained, policy-driven access control at the catalog, schema, table, and column level.
How it works
- A user submits a query to Apache Trino, referencing one or more catalogs, schemas, and tables.
- Apache Trino calls Cerbos for each authorization check, passing the authenticated user, the target resource, and the requested operation.
- Cerbos evaluates your policies, checking user roles, resource attributes, data classification labels, and any custom conditions.
- Apache Trino enforces the decisions, allowing the query to proceed or returning an access denied error.
Column-level security and data governance
Cerbos policies can restrict access at the column level, making it straightforward to implement data masking or redaction for sensitive fields. Define policies based on data classification labels, PII columns visible only to compliance roles, financial data restricted to the finance department.
Get started
Cerbos authorization for Apache Trino is available as part of Cerbos enterprise. Talk to us to learn more about securing your Apache Trino deployment with Cerbos policies.
FAQ
How does Cerbos integrate with Apache Trino?
Cerbos implements Apache Trino's system access control SPI. When users run queries, Apache Trino delegates authorization checks to Cerbos, which evaluates your policies against the user's identity, the catalog/schema/table being accessed, and the operation being performed.
What level of access control does Cerbos provide for Apache Trino?
Cerbos can authorize at every level Apache Trino supports, catalog access, schema visibility, table and column-level permissions, and query execution. You can write policies that restrict specific users to read-only access on certain schemas or limit column visibility based on data classification.
Can I manage Apache Trino and application authorization in one place?
Yes. Cerbos provides a single policy engine for both your application and data platform. The same policy language and management workflows apply across your entire stack.
Learn more about Cerbos
Related integrations
View all integrations →
Cerbos + Apache Trino
- Apache Trino delegates authorization to Cerbos via native integration
- One set of policies enforced across the entire stack
- Unified audit trail for all authorization decisions
- Policies managed without code changes or redeployments
Authorization for AI systems
By industry
By business requirement
Useful links
What is Cerbos?
Cerbos is an end-to-end enterprise authorization software for Zero Trust environments and AI-powered systems. It enforces fine-grained, contextual, and continuous authorization across apps, APIs, AI agents, MCP servers, services, and workloads.
Cerbos consists of an open-source Policy Decision Point, Enforcement Point integrations, and a centrally managed Policy Administration Plane (Cerbos Hub) that coordinates unified policy-based authorization across your architecture. Enforce least privilege & maintain full visibility into access decisions with Cerbos authorization.