Data Governance
Data Governance restricts which rows a role can see (row filters) and hides or masks specific columns for that role (column masking). Both are enforced by the database proxy at query time — not just hidden in the UI.
Selecting a role and environment
Pick a Role and an Environment (Shared or Dedicated schema) to configure. Row filters and column rules are defined per role, per environment.
Dedicated schema requires the Pro plan or above — on Free, App Lite, and Starter, only the Shared schema is available.
Once a role is selected, two cards appear side by side: Row Filters and Column Masking.
Row Filters
A row filter restricts which rows a role can access in a table — for example, only rows where department = 'Sales'. Click Add Filter to create one:
- Access Type — Allow (matching rows are accessible) or Deny (matching rows are hidden).
- Applies To — Read Only, Write Only, or Read & Write.
- Table and Schema (locked to the role/environment you selected).
- Filter Expression — built visually, not typed as raw SQL. Add one or more conditions (column, operator, value), combine them with All conditions (AND) or Any condition (OR), and use Validate Expression to check it before saving. A Generated SQL preview shows the resulting expression.
Instead of a fixed value, a condition can reference the current request using a dynamic variable: @current_user_id, @current_subscription_id, @current_user_email, or @current_roles — this is how you write a rule like “only rows created by the current user.”
A Deny filter with no conditions blocks all rows for that role. An Allow filter with no conditions makes all rows visible — double-check which one you meant before saving.
Column Masking
Column rules hide or obscure specific columns for a role. Click Add Column Rule, pick a Table then Column, and choose what to apply:
- Mark as Sensitive — flags the column for audit logging.
- Enable Masking — shows a partial value instead of the real one, using a Mask Pattern:
| Pattern | Example |
|---|---|
| Credit Card (last 4) | ****-****-****-1234 |
| SSN (last 4) | XXX-XX-1234 |
| Email (masked) | j***@e***.com |
| Phone (last 4) | +1-XXX-XXX-5678 |
| First 3 chars | Joh*** |
| Last 4 chars | ****6789 |
| SHA-256 Hash (8 chars) | a1b2c3d4 |
| Replace with NULL | NULL |
| Full Redact | ******** |
| Custom Pattern | your own #/X/* template |
A live preview shows a sample value transformed by the pattern you pick.
Marking a column Sensitive without enabling masking blocks that role from querying it entirely — any query selecting that column fails for them.
Testing your rules
The Test Governance Rules card runs a real SQL query through the database proxy, with the selected role’s rules actually applied — not a simulation.
Results show which row filters and column rules were applied, how many rows came back versus the table total, and which columns were masked or hidden in the output.
Common issues
- A query returns no rows in the test panel — A Deny row filter (or an Allow filter with no matching conditions) may be excluding everything for this role.
- A column shows blocked instead of masked — It’s marked Sensitive without masking enabled; either enable masking or unmark Sensitive.
- Can’t select Dedicated environment — Requires a Pro plan or above.