sparql-guardAccess control for any SPARQL endpoint

Graph-level and row-level policies written in SHACL, enforced by rewriting queries in a proxy in front of your triple store.

Get started

Try the playground

How it works

Store-neutral

Works in front of any SPARQL 1.1 endpoint, whether that is Fuseki, GraphDB, Virtuoso, Stardog, Oxigraph or QLever. One policy model instead of one per vendor.

Policies in SHACL

Row-level rules are ordinary SHACL shapes: "an employee is visible if it belongs to Sales", "documents are visible to their owner". No new rule language to learn.

Rewrites, not post-filters

Aggregates, FILTER EXISTS, MINUS, OPTIONAL and sub-queries all run over the restricted view, so counts and joins cannot leak hidden data.

Fails closed

SHACL it cannot translate stops the policy from loading. Queries it cannot rewrite safely, such as SERVICE or updates, are refused rather than passed through.

Built on Traqula

Queries are parsed into SPARQL algebra, rewritten and generated back with Comunica's Traqula, not with regular expressions.

Ready to deploy

A small Node.js service with a container image, API keys or identity from your auth proxy, live policy reload and an explain endpoint.