Tags and masking

A tag says what a column holds: customer_id, email, national_id. Each tag in the vocabulary has a sensitivity, none, personal or sensitive, and the sensitivity decides masking.

Masking. When your role does not hold personal data on a source's tier, every column tagged personal or sensitive is masked on the agent, before the answer leaves your network. The mask keeps the value's shape where that is safe: - email: the first letter and the domain, d••••@example.com - national_id: the last four digits, •••-••-9845 - payment_card: the last four, •••• 1111 - person_name: initials, D. O. - date_of_birth: the year - anything else personal or sensitive (phone, postal_address, free_text, health_record): masked whole

A role that holds personal data on the tier sees the values whole, and the call's audit row says pii: shown.

Before anyone tags a column. Its name is enough: ssn, email, full_name, card_number, date_of_birth, phone and their like are masked from the first day. A tag a person applies wins over the name, including a tag of sensitivity none.

Filters. A role without personal data may not filter, join or sort on a sensitive column: a WHERE on a social security number would answer whether a guess is right, which is the value by another road. It may still select it, masked.

The vocabulary. customer_id, account_id, order_id, identifier, amount, currency, timestamp and status are none. person_name, email, phone, postal_address and free_text are personal. national_id, date_of_birth, payment_card and health_record are sensitive.

Tags change only when a person applies a proposal: see Proposals.