Qualifying Observation Integrity for Selective Authorization in PostgreSQL

Abstract Selective authorization reuses an earlier policy decision when the database observations supporting that decision remain unchanged. Epoch counters can support this inference only when installed mutation code advances the intended identities and the executor faithfully observes those advances. This study formulates that producer-to-consumer contract and implements a restricted PostgreSQL installation qualifier. Two motivating counterexamples preserve apparently correct helper code or marker updates while breaking the inference: reordered formal parameter names redirect invalidation, and row-level security hides correctly maintained markers. The qualifier combines restricted code checking with function binding, control-storage, role and trigger-attachment checks. Separately authenticated writer and executor sessions provide a complementary behavioral oracle. A conditional composition argument explains safe reuse; a constructive counterexample shows why finite positive visibility probes cannot establish an unrestricted contract. On authenticated PostgreSQL 16.15, 48 valid catalog controls qualified and 48 incompatible variants were refused. A frozen 108-pair challenge produced zero unsafe qualifications in five unsafe configurations, versus two for a fixed structural lint, while refusing two safe unsupported forms. The purchase protocol passed 22 checks. In 540 measured cycles on PostgreSQL 16.15 under full-system CPU emulation, selective execution reduced the 10,000-row unchanged-state median cycle time by 24.0% relative to repeated native SQL evaluation with the same epoch maintenance; relevant mutations increased costs. The result is an executable qualification method with explicit correspondence obligations, reproducible failure evidence and measured support limitations.