Multi-Domain Data Governance
with ABAC

The Problem

A single table holds data from multiple business domains. Each domain owns certain columns, and each column has a sensitivity level. The challenge: apply the right mask per domain × sensitivity combination, without policies conflicting with each other.

The 2D Tagging Pattern

Every sensitive column gets two tags: one for which domain owns it, one for how sensitive it is. Policies then match on AND conditions — both tags must match. This ensures exactly one policy applies per column per user, eliminating conflicts.

-- Two tags per column: domain ownership + sensitivity level
ALTER TABLE {catalog}.{schema}.employee_records
  ALTER COLUMN employee_name SET TAGS ('abac_tut_domain' = 'hr', 'abac_tut_sensitivity' = 'internal')

ALTER TABLE {catalog}.{schema}.employee_records
  ALTER COLUMN ssn SET TAGS ('abac_tut_domain' = 'hr', 'abac_tut_sensitivity' = 'confidential')

Policy Matrix

Six policies — one per domain × sensitivity combination. Each uses an AND condition and exempts only the owning domain group.

-- AND condition ensures exactly one policy matches per column
CREATE OR REPLACE POLICY mask_internal_hr
ON SCHEMA {catalog}.{schema}
COLUMN MASK {catalog}.{schema}.partial_mask
TO `account users` EXCEPT abac_tut_hr_team, abac_tut_admins
FOR TABLES
MATCH COLUMNS (
  has_tag_value('abac_tut_domain', 'hr')
  AND has_tag_value('abac_tut_sensitivity', 'internal')
) AS m
ON COLUMN m

Row Filtering + Column Masking Together

Region-based row filters run alongside domain column masks. A US team member in the HR group sees only US rows, and within those rows sees HR columns unmasked but other domains masked.

Query results — EU team (no domain group)

Query results — HR team (US region)

Why This Pattern Scales

Adding a new domain (e.g., Legal) requires only:

1. Add legal to the abac_tut_domain governed tag values
2. Create group abac_tut_legal_team
3. Add two policies: mask_internal_legal, mask_confidential_legal
4. Tag the new columns with domain=legal + sensitivity=internal/confidential

Zero changes to existing policies, UDFs, or other domain configurations.

Telecommunications providers must protect CPNI — call records, data usage, and billing information that reveals subscriber service patterns. This example applies the same domain × sensitivity pattern across three regulated domains.

Service-type row filtering

Each regional team sees only subscribers on their service type. The bundle team sees all service types since they support bundle customers who use both voice and data.

-- Bundle team sees all service types
CREATE OR REPLACE FUNCTION {catalog}.{schema}.service_type_filter_bundle(svc_type STRING)
RETURNS BOOLEAN
RETURN svc_type IN ('bundle', 'voice', 'data')

CREATE OR REPLACE POLICY telco_service_row_filter_bundle
ON SCHEMA {catalog}.{schema}
ROW FILTER {catalog}.{schema}.service_type_filter_bundle
TO abac_tut_apac_team
FOR TABLES
MATCH COLUMNS has_tag('telco_service_type') AS svc_col
USING COLUMNS (svc_col)

CPNI verification — EU team (data service)

Expected results by team