Create a data access rule

Requirements and permissions

  • You have a global role that has the Protect > Edit or Protect > Administration global permission.
  • You have the Catalog global role. This role is required to view data classifications for selection in a data access rule.

Before you begin

Ensure that Protect groups have been created.

Steps

  1. Open Protect.
  2. Click the Data Access Rules tab.
  3. Click Create a Data Access Rule.
    The Create a Data Access Rule dialog box appears.
  4. Enter the required information.
    FieldDescription
    Rule NameEnter a name for the data access rule.
    Optional: DescriptionEnter a description for the data access rule.
    GroupSelect the group for the data access rule.
    Tip You can add more groups by using the plus icon.
    Asset

    Select the data asset that the rule is protecting.

    Tip 
    • This field contains Business Process, Data Category, and Data Set assets, in addition to assets of custom asset types.
    • For more information, go to Technical background and Prescriptive paths.
    • You can add more groups by using the plus icon.
    Optional: With (masking option)
    • Select the type of masking that you want to apply to a data category or data classification.
      Tip This field contains the following options:
      • Default masking
      • Hashing
      • Show last
      • No masking

    • Click Data Category or Data Classification, and then select the data category or data classification for the selected masking option.
    Tip You can add more data categories and data classifications for masking by using the plus icon.

    Optional: And (action)

    1. Select the type of row-filtering action that you want to apply to a data classification with a specific code set and code value.
      2. Tip This field contains the following options:
      • Show
      • Hide
    2. In the rows where field, select the data classification that you want to show or hide.
    3. In the has field, select the code set for the selected data classification.
    4. In the next field, select the code value for the selected code set.
    Tip You can add more data classifications for row-filtering by using the plus icon.
    Tip 
    • The Grant access to the data linked to these assets checkbox, which is selected by default, is applicable to only Snowflake. A selected checkbox indicates that you are allowing the selected groups to access those tables and columns in the database that are linked to the selected assets. If you do not want the selected groups to have this level of access, clear the checkbox.
    • The Summary section shows a summary of the rule.

    Create a Data Access Rule dialog box

  5. To preview the rule, click Generate Preview.
    Tip The preview shows only the first 1,000 affected columns. The drop-down list box below the Generate Preview button is used to switch between the assets that you selected in the rule. Each asset has its own preview table.
  6. Click Save Rule.
    A message appears stating that the rule is sent to source, and the rule is shown in the table on the Data Access Rules tab.