Execution context

Sources

Docs: Panes, Plots, Policies, and Preferences. Web App: The Current/Report picker chooses a data reading. Pane code reads the host’s coordinates through getParableContext().

Structure

A definition identifies code and schema. A data reading identifies Current data or one Report run. React and SQL use the same context so a page can display an older Report with a newer compatible definition without confusing the two.

import { getParableContext } from '@parable/example/queryBuilder';
const context = getParableContext();

The host supplies the authenticated identity. Selecting another actor’s scenario changes an input; it does not impersonate that actor.

Schema

Field	Meaning
`workspace.workspaceId`	Workspace membership and data boundary, including Dogfood for Admin Parables.
`parable.parableId`, `parable.handle`	The application being used.
`parable.revision`	A published commit, or a draft ref and its revision.
`data`	`CURRENT`, or `REPORT_RUN` with a specific `reportRunId`.
`principal`	The actor whose authority executes the operation; always present.
`actor`	The initiating actor, when there is one. Scheduled work has no human initiator.
`raci`	Current Parable participation for presentation.
`permissions`	Reserved empty array; it does not supply grants.
`mode`	Personal/published presentation state, not permission.

TypeScript and Rust share this generated data model. A context names either a commit or a ref with revision, never both. props.policies separately supplies resolved Pane decisions; context fields and displayed capability booleans are not credentials. A saved Plot’s result.meta identifies the data that actually answered it. For example, Current can resolve to Report R42 produced by definition v6 while meta.context still describes the consuming v7 definition. The returned reading identifies R42; changing the definition label would not make its data compatible.

Services

The Pane SDK binds requests to the host-selected definition and reading. It resolves source identities on the server, so a named SQL read does not require downloading private SQL. It also uses resolveParablePanes to resolve explicit values and policy decisions; hidden or unavailable items return individual refusals without discarding their permitted siblings. SQL reads the same context:

SELECT
  parable_context()['principal']['actorId'] AS execution_actor,
  parable_context()['parable']['revision']['commitId'] AS definition;

A query without a Parable definition can inspect its verified principal:

SELECT request_principal()['actorId'];

principal.email, when present, comes from the authenticated account. Neither Provider identity matching nor an application parameter can replace it. Unknown context fields fail planning. parable_context() requires a trusted Parable context; it does not invent a default identity. When definition, reading, or authority changes, the host replaces the relevant bindings and ignores responses from the earlier selection. Draft requests can carry expectedRefRevision; a stale revision conflicts rather than running old code with a new label. Separate Current queries remain live and do not promise one atomic snapshot across the whole page. Positional SQL parameters remain separate from context. Omitting an override uses saved values; an explicit array replaces them. Existing Report data keeps its captured inputs and refuses a different override. Parameters cannot change the requester, Workspace, definition, or policy decisions. Ponder’s Pane pictures use a captured reading with the requester’s verified context, Pane references, and policy decisions. They can read only the captured Preferences; they cannot run live SQL or write values. A missing or denied required reference makes the picture unavailable. The picture does not invent an actor, version, or permission to complete a render.

Security

Workspace surfaces check active membership, Parable participation, and current Policies on the server. Admin Ponder can inspect a definition and reconstruct its context for an active staff account without granting Workspace membership, after the Admin Ponder permission, selected Workspace line, direct RACI seat, and current Policies pass. Definition edits remain governed by their authoring Policies. Selecting an Admin Workspace keeps the same authenticated account. Plot planning, including preparation for publication, and live SQL execution still require that account’s active Workspace membership. Definition access alone does not authorize those operations; a direct RACI seat or Admin role cannot replace membership. The host resolves request coordinates and strips untrusted context metadata before forwarding queries. A prepared query or page cursor cannot be reused under another actor, definition, or reading. Returned policy authorityKey values invalidate stale presentation; they do not authorize writes. A preview is governed by its actual inputs. A saved named SQL output also applies its Data Policies. Source restrictions run before projection, joins, aggregation, and limits. A SQL alias cannot remove an attached rule. For example:

original_user_email = request_principal()['email']

An absent email does not match. A missing governing policy, unsupported evaluator, or invalid condition refuses access. Preference filters receive record metadata and typed value; SQL-output filters receive result columns. The current filter language accepts scalar conditions and ANDs them together; volatile functions, placeholders, aliases, and subqueries are refused. A scheduled Report executes as the Workspace’s explicit principal and uses that Workspace’s participation and current source/output permissions. It does not borrow its creator’s credentials. A manual Report uses the authenticated requester, whose authority is checked when execution starts.

Stability

Pipeline Current reads the latest completed compatible Report. Selecting a run keeps that exact Report, and missing or incompatible data is refused. Report provenance stays separate from the selected code version and from current access. Provider input replay is not implemented. A historical result with a request_principal() Provider filter requires its captured principal, including email. A Provider filter using full parable_context() currently refuses Report materialization. Typed Preference inputs can instead be checked using captured values under current Policies; deleting or hiding an input can make the result unavailable. A Report cannot yet bind the newly produced output of another pipeline Plot in the same run. Ordinary SQL and previews can query completed pipeline results with either Current or an explicit Report selection.

​Sources

​Structure

​Schema

​Services

​Security

​Stability