Enforces GrantForge policies in Apache Doris with Doris's own access control: a service beside the cluster that keeps one role per user holding exactly what the service's signed policies give the user, down to columns and workload groups, and one row policy per row filter, in step with the policies, the users and the tables, and undoes changes made to them by hand. It reports accesses from Doris's audit log table, saying whether GrantForge or a grant outside it ...