Guidelines for sequencing data access policies for application
As a Data Steward, you manage data access policies to determine under what conditions Data Governance and Catalog processes them.
The following list describes guidelines for applying each type of policy:
•You don't need to determine the order of data access control policies because they are cumulative. If a policy grants a user group read access to a given table, and another policy grants that user group write access to the same table, the user group will have read and write access to that table.
•You don't need to determine the order of data filter policies because they are cumulative. For each policy that applies in a given context, Data Governance and Catalog increasingly restricts access to the data by filtering the rows returned. Data Governance and Catalog processes all data filter policies simultaneously, and within each policy, Data Governance and Catalog processes all data filter rules simultaneously. If multiple data filter rules match the context, Data Governance and Catalog applies all those rules.
•You need to determine the order of data de-identification policies.
- You place each data de-identification policy in a precedence tier. Data Governance and Catalog processes precedence tiers based on rank from lowest integer to highest.
- Within each precedence tier, Data Governance and Catalog processes data de-identification policies from top to bottom.
- Within each data de-identification policy, Data Governance and Catalog processes data de-identification rules from top to bottom. If multiple data de-identification rules match the set of conditions for a given request, Data Governance and Catalog runs the first rule in order, applies data protections to any relevant fields based on data element classifications, and then prevents any other rules from executing on the same field.
- Within data de-identification rules, Data Governance and Catalog processes the sequence of classifications within the rule from top to bottom. Cell-level de-identifications take precedence over field-level de-identifications.
When Data Governance and Catalog processes data de-identification policies, it starts by processing a precedence tier. Inside the precedence tier are policies. Data Governance and Catalog evaluates the first policy. It first determines whether there is a policy condition. If there is, it evaluates that condition. Since that condition applies, it evaluates the rule condition. If that condition applies, it applies the data protection to the data associated with that data class. If there are more data classes, the process repeats until there are either no more data classes to evaluate or no conditions that apply. Data Governance and Catalog applies the default data protection to any remaining data classes.
The following image shows the data de-identification policy evaluation process:
