...
Data Class → | Generally Available (Green) | Confidential (Yellow) | Restricted (Red) |
|---|---|---|---|
Audience | All data access roles (not public) | Dean/Division Leader Role | Reporting and Compliance Roles (University-wide access as needed) Others must provide justification for use |
Identified data | Reporting and Compliance Roles (University-wide access) | ||
Types of Data | •Name •Title (fac/staff) / Level (students) •HR Title (fac/staff) •Department / Program •Supervisor •Campus •Pronouns (user provided) •Email address •Affiliations (faculty/staff/student/...) •Classification (temp, post doc, RA, staff/grade, faculty) | •Compensation •Course registrations •Age range (..., 25-35, 36-45, …) •Financial transaction data •Leave/return dates •Service dates •Space assignments •Grant proposals and awards •Enrollment status •Home address •Local address •Alum/donor name/contact info •Citizenship | •Race/ethnicity •Gender identity •Religion •PHI •Marital status •Date of birth •Benefit selections •Admissions decisions (before release) •Grades •Alum/donor gift history •Social security number •Driver’s license number •Passport number |
...
| Code Block |
|---|
CREATE OR REPLACE ROLE confidential ''
GRANT CONNECT, METADATA, EXECUTE ON test
CREATE OR REPLACE TAG confidential
DESCRIPTION = 'Used to tag views or columns that fall under the Confidential data definition';
CREATE OR REPLACE GLOBAL_SECURITY_POLICY mask_confidential_columns
DESCRIPTION = 'For non-RLS views, masks all columns with the confidential tag for non-admins without the confidential role'
ENABLED = TRUE
AUDIENCE (
NOT_IN ROLES (confidential, "grp_ds_denodo-admin", restricted)
)
ELEMENTS (
VIEWS NOT TAGGED (rls_dept)
)
RESTRICTION (
FILTER = ''
MASKING ANY (confidential) WITH (HIDE) (numbers WITH DEFAULT, datetimes WITH DEFAULT, texts WITH DEFAULT)
);
|
Restricted
VQL
| Code Block |
|---|
CREATE OR REPLACE ROLE restricted ''
GRANT CONNECT, METADATA, EXECUTE ON test;
CREATE OR REPLACE TAG restricted
DESCRIPTION = 'Used to tag views or columns whose data fall under the Restricted definition'
CREATE OR REPLACE GLOBAL_SECURITY_POLICY mask_restricted_columns
DESCRIPTION = 'For non-RLS views, masks all columns with the confidential tag for non-admins without the confidential role'
ENABLED = TRUE
AUDIENCE (
NOT_IN ROLES ("grp_ds_denodo-admin", restricted)
)
ELEMENTS (
VIEWS NOT TAGGED (rls_dept)
)
RESTRICTION (
FILTER = ''
MASKING ANY (restricted) WITH (HIDE) (numbers WITH DEFAULT, datetimes WITH DEFAULT, texts WITH DEFAULT)
); |
...
| Code Block |
|---|
select * from test.clsrls_test context('impersonate_roles'='data_strategy'); |
...
Tableau does not currently have an easy way to check for membership against a list of multiple groups.
Other Tableau User Function can be found here: https://help.tableau.com/current/pro/desktop/en-us/functions_functions_user.htm
...