in Access Policy
transformations, use the following guidelines as best practices.
Data Integration
treats both date and
timestamp data types as timestamps. As a best practice, in
Data Access Management
, create a
data filter rule
or a
cell-level
de-identification
with two
distinct criteria. In one criterion, use the date data type. In the other criterion, use the
timestamp data type with the same values as the first criterion. This second criterion is
for the Access Policy transformation.
In order to provide flexibility for a variety of use cases, the Access Policy transformation
appends a new field called access_policy_filter that indicates whether a row is affected by
data filter policies
. For most use cases, it is appropriate to filter out these rows and the
access_policy_filter field from the output.
When your data source includes additional columns not defined in the table, start the name of
appended columns with “cdamx_”. If you need to pass additional column through an Access Policy
transformation, you can select “Query” from the Source Type menu and start the name of the
appended columns with “cdamx_”.
The following image shows the Source tab for a source:
For example, if you want to add the row number to the existing table, you can write a
query to select all columns as they appear in the catalog and append the row number column
as "cdamx_rownum".
The access_policy_filter field displays FAILURE_FIELD when
Data Access Management
is unable to
apply a
data protection
. The field is redacted with null. This can occur when a field's value
does not meet the criteria specified in a
data protection
's regular expression
syntax. For example, a
data protection
might specify
consistently randomizing a five-digit postal code. If a field contains more than five digits,
the access_policy_filter field displays FAILURE_FIELD and the field is redacted with
null.
Use the following best practices when defining Access Policy transformations that include
data access policies
:
Add a Filter between the Access Policy transformation and the Target.
On the Incoming Fields tab, include all
fields.
On the Filter tab, add a simple filter condition for the field name
access_policy_filter with a value of ACCESS_DENIED.
The following image shows the
Filter tab:
Select the Target in your mapping.
On the Incoming Fields tab, exclude the field named access_policy_filter.
The following image
shows the Incoming Fields tab for the Target:
When setting Source Type to Query, manually
set the Asset parameter.
If you select “Query” from the Source
Type menu, you must select "Override Asset Name," search for, and select the data
asset.
ASK INFAPreview
