You can mask data based on the user name or the Data Archive access role of a user. It is recommended to mask data based on the Data Archive access role. When you create a security rule in Dynamic Data Masking, you specify the user or access role that the rule applies to.

When the Data Archive client sends an SQL request to the Data Vault, it appends a multi-line SQL comment to the request that contains encrypted user and user role information. Dynamic Data Masking decrypts the comment and uses the Java class GetUsersAndRolesFromComment to create symbols.

The following table describes the symbols that the GetUsersAndRolesFromComment Java class creates:

Symbol	Description
DataArchive_User	The Data Archive user.
DataArchive_Roles	A list of shuffled Data Archive access roles separated by commas.

You must create a rule in Dynamic Data Masking that uses the GetUsersAndRolesFromComment Java class so that Dynamic Data Masking decrypts the SQL comment.

Because Data Vault does not allow multi-line comments, the request fails if Dynamic Data Masking does not decrypt the comment. If Dynamic Data Masking encounters an error during decryption such as a missing comment or the wrong comment format, Dynamic Data Masking returns the original SQL statement and does not define values for the DataArchive_User and DataArchive_Roles symbols.