The masking is bound to who is asking, not to what they ask

The external analysts and the on-call engineer query the same SQLite service at the same URL. They sit in different permission groups, and one of the groups has a hook.

The hook is registered on the sqlite service with a match on POST /api/v1/sqlite/db* and applies_to: {"groups": ["analysts"]}. Requests from the internal group never see it. Requests from the analyst group are dispatched to a script in your own hoody-exec. The script calls metadata.hook.fetchUpstream(req), reads the rows, nulls the email and phone columns, and hands the result back through pipeResponse. The query is untouched. The answer is what changes.

Before, this was a second database, a view per role, or a WHERE clause every analyst promised to remember. Now it is one rule in the permissions document, evaluated by the proxy before the query reaches the file.

The masking is bound to who is asking, not to what they ask.