Knobit of Data modelling · K-821 · Skill

Recognises a restricted column without access design

What it means

A column classified `restricted` or `confidential` in the model, created by a plain `CREATE TABLE`. The generator deliberately emits no `GRANT`, role, masking policy or row-level security, so the finding is never "the SQL is missing them" — it is that nothing else covers them and the table is about to exist where everyone can read it.

How it is assessed

Flags the deficient case and passes the acceptable one. Deficient: `dim_party.birth_date` and a card number column, both `restricted`, created in `rpdm` with no masked view, no role and nothing in the handover; a full PAN sitting in an analytics schema forty analysts can query Acceptable: The restricted columns listed in the handover with the access design each needs — a masked view, a separate role, the PAN truncated to the last four digits or left in the card system — written and reviewed as its own script. The classifications drive that conversation; they do not generate it

Builds on

Explains access design for classified dataK-856 · Knowledge

Needed by

None