Dynamic Data Masking

evaluates rules in the Rule Editor from the top to the bottom. Therefore, if you create non-masking rules, you must put them above any masking rules you create so they can be effective.

Dynamic Data Masking

does not mask data in the database. When you view data in the

MDM Hub

, the data appears masked. Use Create View statements in

Dynamic Data Masking

to give users privileges to view unmasked data.

To block users from adding a record to which masking is applied, you must create a separate rule for each affected base object. Define a text matcher as

%INSERT%<BO_NAME>%<ROLE NAME>%

and the Block Statement processing action.

By default, the

Dynamic Data Masking

engine prevents users from editing tables with masked data. If you want to update masked data in the

MDM Hub

, you can create a rule in the

Dynamic Data Masking

Rule Editor to allow a user to update masked columns.

In the

MDM Hub

, the user MDM_SYSTEM is an internal indicator for system calls. MDM_SYSTEM does not appear in the roles list in the

Hub Console

.

Dynamic Data Masking

applies masking based on the

MDM Hub

roles that a user has. When you create

Dynamic Data Masking

rules in the Rule Editor, do not create rules for the MDM_SYSTEM indicator alone. YouChart of Accounts Installation and Configuration Guide must combine MDM_SYSTEM with a user name or roles that belong to a user. You can combine the MDM_SYSTEM indicator with any other rule to create fine-grained rules in

Dynamic Data Masking

.