RocksDB Column Families and Application-Layer Access Control Integration

RocksDB is an embeddable persistent key-value store that lacks a native network layer, meaning it does not provide built-in authentication or credential management. Security boundaries and least-privilege access must be implemented entirely at the application layer.

When utilizing Column Families to partition data into logical stores, the isolation is logical rather than physical, as these families share the same underlying storage files and write-ahead logs. This architecture creates a challenge for applications that need to map specific user credentials to restricted access for individual Column Families.

Given that the storage engine does not track identity, the application must manage the mapping between authenticated sessions and the corresponding ColumnFamilyHandle.

• How can an application efficiently invalidate access to specific Column Families when credentials expire without restarting the DB instance?
• What is the recommended pattern for ensuring that a handle passed to a worker thread cannot be used to access unauthorized Column Families?