Data access policies control which data users can see within a catalog, beyond catalog-level access. e6data supports two policy types: column masking (obscure sensitive column values) and row filtering (limit which rows a user can see). Both are created from a catalog’s Privilege tab.
Column masking
Column masking obscures sensitive data in specific columns from users who lack the appropriate privileges. Authorized users see the full data; others see a masked version. Supported masking types:
- Mask - replace the entire value with placeholder characters (regex replacement).
- Mask first 4 characters - keep the first four characters, mask the rest.
- Mask last 4 characters - keep all but the last four characters.
- Hash (SHA-256) - replace the value with an irreversible SHA-256 hash.
Create a column-masking privilege
- Navigate to Catalogs and click the desired catalog.
- Select the Privilege tab.
- Click Create Privileges and give the privilege a name (and optional description).
- Select Column masking as the privilege type.
- Select the databases and tables.
- Select the columns and the masking type for each.
- Select the user(s) and group(s) the privilege applies to.
- Click Create. The privilege appears in the Privileges list.
Limitations
- Column masking applies only to string data types.
- For string fields with 4 characters,
show_first_4 and show_last_4 display the field unmasked.
- When masked columns are used in string functions, governance applies the string function first, then masks the result.
- Masking is not supported for values with special characters.
- Masking of values in
json_value functions is not supported. If a masked column is aggregated, the final output is not masked.
Row filtering
Row filtering limits which rows a user can see based on a condition - useful when different users need access to the same dataset at different scopes (for example, sales reps seeing only their assigned customers).
Create a row-filter privilege
- Navigate to Catalogs and click the desired catalog.
- Select the Privilege tab.
- Click Create Privileges and give the privilege a name (and optional description).
- Select Row filter as the privilege type.
- Select the databases.
- Select the table and enter the filter expression (for example,
cc_employees=6879074).
- Select the user(s) and group(s) the privilege applies to.
- Click Create.
The filter applies only to the selected table(s) and user(s) - other tables and users are unaffected.
Limitations
- Subqueries in row-filter conditions are not yet supported.
- Row-filter conditions with aggregate functions are not yet supported (aggregations belong in the
HAVING clause).
- For multiple row filters on the same table, only the first filter applies in a query that combines them.
Edit or delete a policy
To edit, click the three dots next to the privilege, select Edit, change the databases, tables, columns/expression, or assigned users and groups, and click Update. To delete, select Delete from the same menu and confirm by typing Delete.
See also
Last modified on September 29, 2026
