We have sourcehub for data access policies which is our layer for gov! The db just ties signatures and identity to each action to make it enforceable from the data layer alone.