DSL describing permitted operations over a data store to ensure data protection