A PostgreSQL connection succeeds.

Your application runs a query.

Everything looks normal.

But how do you know that connection is operating under the correct tenant's permissions?

That's the problem I've been exploring while building Agata Proxima.

Instead of relying entirely on application-level tenant filters, I built an open-source Rust proxy that sits between an application and its existing PostgreSQL database.

Here's how it works.

The application connects to the proxy

Your application keeps its PostgreSQL driver. Instead of connecting directly to PostgreSQL, it connects to Proxima Engine.

The engine accepts PostgreSQL-protocol connections and handles the connection startup process.

Tenant identity is verified

When tenant enforcement is configured, the engine validates signed tenant context.

That includes checking the tenant identifier, token expiry, and signature.

Invalid or missing tenant context is rejected.

The important distinction: the engine doesn't simply trust a tenant ID supplied…