Enforces GrantForge policies in ClickHouse with ClickHouse's own access control: a service beside the servers that keeps one role per user holding exactly what the service's signed policies give the user, down to columns, and one row policy per row filter, in step with the policies, the users and the tables, and undoes changes made to them by hand. It reports accesses from ClickHouse's query log, saying whether GrantForge or a grant outside it decided each, and ...