Least privilege, enforced at the wire-protocol level — on autopilot.

# Connect a resource
resource "formal_resource" "production_pg" {
  name       = "production-postgres"
  technology = "postgresql"
  hostname   = "db.internal.company.com"
  port       = 5432
}

# Mask PII for non-privileged users (Rego)
resource "formal_policy" "mask_pii" {
  name        = "mask-pii-data"
  description = "Mask PII fields for non-privileged users"
  status      = "active"

  module = <<-EOT
    package formal.v2
    import future.keywords.if
    import future.keywords.in

    response := {
      "action":  "mask",
      "type":    "nullify",
      "columns": pii_columns
    } if {
      not "pii_access" in input.user.groups
      pii_columns := [col |
        col := input.columns[_]
        col.data_label in ["email", "ssn", "phone"]
      ]
      count(pii_columns) > 0
    }
  EOT
}

import * as formal from "@pulumi/formal";

// Connect a resource
const db = new formal.Resource("production-pg", {
  name:       "production-postgres",
  technology: "postgresql",
  hostname:   "db.internal.company.com",
  port:       5432,
});

// Mask PII for non-privileged users
const policy = new formal.Policy("mask-pii", {
  name:        "mask-pii-data",
  description: "Mask PII fields for non-privileged users",
  status:      "active",
  module:      regoCode,
});

# Create a resource
curl -X POST "https://api.joinformal.com/resources" \
  -H "X-API-Key: $FORMAL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "production-postgres",
    "technology": "postgresql",
    "hostname": "db.internal.company.com",
    "port": 5432
  }'

# Create a masking policy
curl -X POST "https://api.joinformal.com/policies" \
  -H "X-API-Key: $FORMAL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "mask-pii-data",
    "status": "active",
    "module": "package formal.v2 ..."
  }'