MODULE 03

Security Fundamentals:
RBAC, Roles & API Keys

Understand DreamFactory's layered security model: Role-Based Access Control, service-level permissions, table and field restrictions, and API key management. This is the foundation that governs every AI interaction with your data.

~7 min read
Foundational
Security Focus
Full Step-by-Step Documentation ~20 min

🔒 Why Security Comes Before Queries

Before any AI agent or MCP tool can access a single row of data, DreamFactory's security layer must explicitly permit it. Every API call (whether from Claude, ChatGPT, a Python script, or a REST client) passes through the same RBAC enforcement pipeline. There are no backdoors and no shortcuts.

This module covers the four layers of DreamFactory security that you need to configure correctly before Modules 04 to 08 will work.

🏗️ The Four Security Layers

Layer 1

Roles

Define named permission sets (e.g., "AI Agent", "Analyst", "Admin"). Every user or API key is assigned to one role.

Layer 2

Service Access

Each role specifies which DreamFactory services (databases, file stores, scripts) it can reach and which HTTP verbs (GET, POST, PUT, DELETE) are allowed.

Layer 3

Table & Field Restrictions

Within a permitted database service, you can lock down access to specific tables and even specific columns. AI agents only see the fields you expose.

Layer 4

API Keys

External clients (including AI tools) authenticate with API keys. Each key is bound to a role and optionally locked to a specific domain or IP range.

⚖️ Open vs. Locked-Down Roles

❌ Over-Permissive Role

  • Full admin access to all services
  • GET, POST, PUT, DELETE on every table
  • No field-level restrictions
  • Shared API key across all AI tools
  • No audit differentiation

✓ AI-Safe Role

  • Access limited to specific database service(s)
  • GET-only on approved tables
  • Sensitive columns excluded (SSN, salary, PII)
  • Unique API key per AI tool or agent
  • Complete audit trail per key

💻 Creating an AI-Safe Role (Example)

Here's a walkthrough of the DreamFactory admin panel flow to create a properly scoped role for AI tools:

DreamFactory Admin Panel 
-- Step 1 - Create a New Role
Name:        "ai-readonly-agent"
Description: "Read-only access for AI tools"
Active:      ✓

-- Step 2 - Assign Service Access
Service:     "mysql_production"
Component:   "_table/customers"
Access:      GET only

Service:     "mysql_production"
Component:   "_table/orders"
Access:      GET only

-- Step 3 - Set Field Restrictions
Table:           "customers"
Allowed Fields:  id, name, company, city, state, country
Excluded Fields: ssn, credit_card, date_of_birth, email

-- Step 4 - Generate API Key
App Name:    "Claude MCP Agent"
Assign Role: "ai-readonly-agent"
API Key:     df_ak_7f3e...auto-generated

Notice how each layer builds on the previous one: the role defines the boundary, service access narrows the scope, field restrictions remove sensitive columns, and the API key binds everything to a specific AI tool with a complete audit trail.

🛡️ Identity Passthrough vs. Static Roles

✓

Multi-User AI Deployments

For multi-user AI deployments, consider Identity Passthrough (Module 05). Instead of a single static role, each AI session inherits the permissions of the individual end-user, including LDAP/Active Directory group mappings. This means the same AI interface respects different permission levels per user.

💡

When to Use Each Approach

Static roles are ideal for internal tools, batch AI processing, and simple chatbot deployments. Identity passthrough is better for multi-tenant SaaS, regulated industries (HIPAA, FedRAMP), and scenarios where individual audit trails are mandatory.

📋 API Key Best Practices

  • One API key per AI tool: never share keys across Claude, ChatGPT, and custom scripts
  • Rotate keys on a regular schedule. DreamFactory makes this a one-click operation
  • Lock keys to specific IP ranges or domains when possible
  • Monitor key usage in the DreamFactory admin panel. Unusual query patterns may indicate a compromised key
  • Pair keys with lookup keys to add another layer of validation

🚀 Next Steps

  • Continue to Module 04 to learn how stored procedures add a deterministic query layer on top of RBAC
  • Review Module 02 if you haven't configured your MCP Server yet, as the API key you create here is what your AI tool will use to authenticate
  • Explore Module 05 for Identity Passthrough patterns in multi-user environments
📖

See Also

What Your CISO Needs to Know About LLM Database Access. All five tested LLM applications were vulnerable to prompt-to-SQL injection. Learn the API abstraction approach that prevents these attacks.

Ready to implement? Get the complete step-by-step guide with screenshots from the DreamFactory admin panel, role configuration walkthroughs, and troubleshooting tips.

Full Step-by-Step Documentation ~20 min