Column Masking

Decide, per column, who sees the real values and who sees them masked.

Column masking is one half of PersivX data governance. It answers "who is allowed to read this field?" — the other half, row-level security, answers "which rows is this person allowed to see at all?"

ℹ️ Enforced in the Query Masking is applied when PersivX builds the SQL, not in the browser. A masked value is never sent to the client, so it cannot be recovered by inspecting the page, exporting the data, or calling the Data API.

Before You Start

The data governance module must be enabled on the server instance. If it isn't, PersivX says so and no rules apply.
Governance must be enabled on the specific datasource.
Rules are edited by users with instance-level access.

Opening the Editor

Open the governance editor for a column to reach the Govern Column Masking dialog. It has three parts: a default visibility, a list of override rules, and a way to test the result for a specific user.

Default Visibility

This is what everyone sees unless an override rule says otherwise.

Setting	What the reader sees
Unmasked	The real value.
Partially masked	`********` followed by the last 4 characters of the value.
Masked	Replaced entirely with `************`.

💡 Start Closed Set the default to Masked and open it up with rules, rather than starting Unmasked and trying to close every gap. A new user then gets the safe outcome by default.

Override Rules

Each rule pairs a visibility with a condition that selects who it applies to. Click Add new rule and set:

Who the Rule Applies To

Condition	Matches on
PersivX User Email	The user's email address.
PersivX User Id	The user's PersivX id.
PersivX User Attribute	A user attribute value, such as Department or Region.
PersivX User Group	Membership of a user group.

Each condition uses one of three operators:

is one of — the value appears in the list you provide
is not one of — it does not
Equals Column Value — the current user's email is compared against a column in your data, so a row's own owner field decides who may read it

A rule can carry more than one condition. Use the + icon on a rule to add another.

Narrowing by Column Value

A rule can optionally add a column value condition — pick an object and attribute, then is one of / is not one of with a value. The rule then applies only where that column matches, so the same column can be masked for some rows and visible for others.

Rule Priority

When several rules could apply to one user, PersivX resolves them in a fixed order:

User-level rules — those naming a user email or id — win first.
Attribute-level rules come next.
Group-level rules come after that.
The default visibility applies if nothing matched.

Where two rules sit at the same level, the more specific one wins — a rule carrying a column value condition beats one without. If they are still tied, the first match wins, in the order the rules are listed.

💡 Rules Are Reorderable Each rule shows its priority number, and rules can be dragged to reorder them. Since ties are broken by first match, order is what settles otherwise-equal rules.

Testing a Rule

Save the rules, then click Test for user and search for a user. PersivX evaluates the rules as that person and marks each rule PASS or FAIL, so you can see exactly which one decided the outcome.

⚠️ Save Before Testing Testing runs against saved rules. Unsaved edits are not reflected in the result.

Reusable Policies

Rather than repeating the same rules on every sensitive column, define them once as a policy and apply it to many columns. A policy carries:

Field	Example
Compliance Type	`GDPR`, `SOC`, `OTHERS`
Policy Name	`PII Masking`, `SSN Masking`
Policy Description	A short overview of what the policy is for

Once a column is governed by a policy, opening its editor shows "This attribute is governed by the policy <name>" instead of the rule list — the rules are edited on the policy, and every column using it changes together.

Draft and Publish

Governance edits are versioned as drafts. Publishing promotes the current draft to the live rule set that queries actually use.

⚠️ Rules Take Effect Only Once Published Saving a rule creates a new draft version. Until you publish, reports continue to use the previously published rules.