Recognises a restricted column without access design
A column classified restricted or confidential in the model, created by a plain CREATE TABLE. The generator deliberately emits no GRANT, role, masking policy or row-level security, so the finding is never "the SQL is missing them" — it is that nothing else covers them and the table is about to exist where everyone can read it.
Can AI do this?
People still lead Few or none of the tested AI models showed they master this. 0 of 10 models master it.
| Model | Tier | Probability of mastery | Status |
|---|---|---|---|
| gemini-4-argon | Flagship | 20% | Not shown |
| gemini-3.1-pro-preview | Flagship | 20% | Not shown |
| gpt-6-astra | Flagship | 19% | Not shown |
| claude-fable-5-1 | Flagship | 23% | Not shown |
| gemini-3.8-flash | Mid tier | 20% | Not shown |
| gpt-6.1-sol | Mid tier | 21% | Not shown |
| claude-sonnet-5-5 | Mid tier | 21% | Not shown |
| gemini-3.5-flash-lite | Low cost | 20% | Not shown |
| gpt-6-luna | Low cost | 20% | Not shown |
| claude-haiku-5-5 | Low cost | 20% | Not shown |
Mastered means a probability of at least 90% that the model has this knobit, estimated from its graded answers. “Not shown” means the answers do not settle it either way. How the models are tested.
What it looks like in practice
Expected result: The column and the grants, masking or row security it needs
How it is assessed: Flags the deficient case and passes the acceptable one. Deficient: dim_party.birth_date and a card number column, both restricted, created in rpdm with no masked view, no role and nothing in the handover; a full PAN sitting in an analytics schema forty analysts can query Acceptable: The restricted columns listed in the handover with the access design each needs — a masked view, a separate role, the PAN truncated to the last four digits or left in the card system — written and reviewed as its own script. The classifications drive that conversation; they do not generate it
Also known as: Restricted column with no access design (generated DDL)
Related knobits
Builds on
All 33 knobits of Generate and review DDL.
Source: Review checklist 08-ddl, row 21; PCI DSS v4.0; this skill (08-ddl.md)