Agent WranglersDEN-29Required
Mask personal columns for everyone outside a named role
Tag every personal column in the warehouse. Mask or hide tagged columns from every role except the few named for them.
How to do it
Most analysis needs counts, not names. Use the warehouse's masking policies or policy tags, or views that leave the columns out, with the base tables closed. The tags come from the metadata in Copy only the personal columns an analysis needs. Log every query on unmasked columns, as Log who reads personal data says.
How to check
Sign in with the analyst role and select a tagged column. The result is masked or refused. A script fails on any personal column in the metadata that has no tag in the warehouse.
Sources
Related rules
- DEN-23 Copy only the personal columns an analysis needs in Data engineering
- DAT-34 Log who reads personal data in Data and databases
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools/column-masking">Agent Wranglers data engineering playbook</a>. In code you write, add a comment next to it with the same link.