> ## Documentation Index
> Fetch the complete documentation index at: https://midplane.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Adversarial corpus

> The repository of bypass attempts that must stay denied and legitimate queries that must stay allowed — the contract the policy engine ships against.

The adversarial corpus is how Midplane earns trust: a curated set of SQL bypass attempts that must stay **denied** and legitimate queries that must stay **allowed**. It is intentionally short on marketing and long on SQL. It exists to answer one question — *what does Midplane actually catch, and where are its limits?*

The corpus lives in the repo as [`docs/adversarial-corpus.md`](https://github.com/midplaneai/midplane/blob/main/engine/docs/adversarial-corpus.md) and mirrors the test suite under [`packages/engine/test/adversarial/`](https://github.com/midplaneai/midplane/tree/main/engine/packages/engine/test/adversarial) **one-to-one**: every row maps to one assertion. Humans review the doc; CI gates on the tests. The corpus is the contract, and the repo is its source of truth.

<Note>
  **100+ bypass attempts denied and 50+ legitimate-query controls allowed (and growing)**, with **100% line coverage** on the policy surface (`packages/engine/src/policy/*`). The repo is the live source of truth for the exact counts. The denials prove Midplane blocks what it should; the allowed controls prove it doesn't break legitimate work. False positives are bugs we triage; bypasses are release blockers.
</Note>

## Conservative by default

When in doubt, the corpus denies. Anything the parser can't faithfully model is denied rather than allowed — Midplane accepts false denials to never accept a false allow. Tightening a known gap is a feature; a missed bypass is a release blocker.

## Categories

The corpus is organized by the rule each shape exercises — `table_access`, `multi_statement`, `dangerous_statement`, `parse_error` edges, and exec side-effects. The [repo](https://github.com/midplaneai/midplane/blob/main/engine/docs/adversarial-corpus.md) groups every entry under these, and [what Midplane blocks](/docs/concepts/table-access#beyond-table-access) explains the rules in plain language.

## Illustrative examples

A few entries, lifted directly from the corpus. The [full set lives in the repo](https://github.com/midplaneai/midplane/blob/main/engine/docs/adversarial-corpus.md) — the source of truth these snippets read from.

### Must stay denied

| SQL                                                     | Verdict | Rule              | Why it matters                                               |
| ------------------------------------------------------- | ------- | ----------------- | ------------------------------------------------------------ |
| `WITH x AS (DELETE FROM y RETURNING *) SELECT * FROM x` | DENY    | `table_access`    | The write hides inside a CTE; the recursive walk catches it. |
| `SELECT 1; DROP TABLE users;`                           | DENY    | `multi_statement` | The canonical Datadog stacked-statement vector.              |

### Must stay allowed

| SQL                                | Verdict | Why it stays legitimate                                                |
| ---------------------------------- | ------- | ---------------------------------------------------------------------- |
| `SELECT 'a; DROP TABLE x; --b'`    | ALLOW   | A stacked-injection-shaped string is still one literal, one statement. |
| `SELECT data->>'name' FROM events` | ALLOW   | Postgres JSON syntax parses cleanly.                                   |

## Known limitations

A few shapes currently **allow** where an audit mindset would prefer a deny. These are documented gaps, not patched-around bypasses — Midplane ships a small, predictable rule surface, and tightening any of these adds policy state deferred to a follow-up release.

| SQL                                | Verdict | Why it's a gap                                                                                                                                  |
| ---------------------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| `SELECT pg_terminate_backend(123)` | ALLOW   | A SELECT-wrapped admin function. AST-level write detection can't distinguish side-effecting `pg_*` functions from pure ones without a denylist. |
| `BEGIN`                            | ALLOW   | Transaction control. Midplane commits per query, so `BEGIN` is a pipeline no-op.                                                                |
| `PREPARE my_p AS SELECT 1`         | ALLOW   | Session-state mutation. Tightening requires session-scope tracking; deferred.                                                                   |

The repo tracks the full list of gaps. If your threat model needs any of these tightened today, that's a known gap rather than a bug — [open an issue](https://github.com/midplaneai/midplane/issues) and we'll either backport the tightening or prioritize it.

## Contribute a bypass

Found a SQL shape that gets through? That's the single highest-leverage contribution to the project. Add a row to the markdown table and a matching assertion in the test suite — kept one-to-one. See [contributing](https://github.com/midplaneai/midplane/blob/main/CONTRIBUTING.md) for the workflow.

<Card title="Adversarial corpus on GitHub" icon="github" href="https://github.com/midplaneai/midplane/blob/main/engine/docs/adversarial-corpus.md" horizontal>
  The full corpus, every category, with the bypass logic cited row by row.
</Card>

## Next steps

<Columns cols={2}>
  <Card title="Threat model" icon="shield-halved" href="/docs/security/threat-model" horizontal>
    What the corpus is proving — the vectors in and out of scope.
  </Card>

  <Card title="Table access & guardrails" icon="ban" href="/docs/concepts/table-access" horizontal>
    The rules in plain language, with examples.
  </Card>
</Columns>