Hi everyone, We'd like to propose CEP-64: Proxy Execution Support [1] for adoption by the community. This feature adds a new PROXY permission to Cassandra which allows operators to give permission to impersonate different users.
Proxy architectures are now a standard part of modern Cassandra deployments, yet today they force operators into an unacceptable choice: forward raw end-user credentials (creating leakage risk and breaking with mTLS/SSO), or collapse everyone into a single service account (losing per-user authorization and meaningful audit trails). Neither option supports production requirements for both a proxy layer and genuine per-user access control. This CEP closes that gap by letting a trusted proxy role execute requests on behalf of specific end-users, with Cassandra enforcing the target user's permissions and recording both the proxy and effective-user identities. The result is the operational benefits of proxies — simplified connectivity, topology hiding, transparent migrations — without sacrificing security or auditability. The CEP is linked here: https://cwiki.apache.org/confluence/spaces/CASSANDRA/pages/440305049/CEP-64+Proxy+Execution+Support Looking forward to the discussion of this CEP here on the dev list. Thanks! [1] https://cwiki.apache.org/confluence/spaces/CASSANDRA/pages/440305049/CEP-64+Proxy+Execution+Support
