Row-level security and access · AutessaDB
Column masking and hidden columns
AutessaDB has column-level security: for each security role, a column is visible, masked or hidden. Masked columns are stored encrypted and shown as a full redaction, the last four characters, or a consistent code; hidden columns do not appear at all; and every reveal of a masked value is recorded in the access log.
-- the problem
Most people need the record, not the account number
Support needs to know which customer called, not their full card or tax number. Without column rules, the choice is all or nothing. Masking lets one table serve everyone, with each role seeing exactly as much of a sensitive field as its job needs.
What you get
- Mark a Short Text or Long Text column masked to store its values encrypted at rest.
- Per role: Visible, Masked (Redact fully, Show last 4, or Hash value) or Hidden.
- Visible lets a person reveal a value with the eye button or all on a page with Show values, and each reveal is recorded.
- Hidden columns are not in that person's schema or results at all.
- Masked columns allow equality operators only; filtering, sorting or grouping on a column you see masked or hidden is refused.
- In the data lake, masked columns still support =, IN, GROUP BY, DISTINCT, counting and joins with other masked columns.
- Downloads contain the mask unless you choose to include values you are allowed to see.
- Column masking is enabled per company.
-- how it works
How does column masking and hidden columns work in AutessaDB?
Mark the column
Set masked on a text column when you create it (or add a new masked column later).
Write the rule
In a role's table policy, choose Visible, Masked or Hidden for the column; columns default to visible, so only exceptions are saved.
Assign
Give the role to the people, teams, apps or keys it should govern.
Review reveals
Read the access log to see who revealed which value and when.
-- every option
Column rule options
| option | what it does |
|---|---|
| Visible | Values can be revealed one at a time or per page; every reveal is logged. |
| Masked: Redact fully | Always shows a full mask (••••••). |
| Masked: Show last 4 | Shows only the last four characters. |
| Masked: Hash value | Shows a code that looks the same for equal values, so you can spot duplicates. |
| Hidden | The column does not exist for that person. |
| Owners and admins | Can always reveal values. |
| Limits | Masking cannot be switched on or off for an existing column; masked columns cannot be partition or sort keys in the data lake. |
-- permissions
Who can do what?
| access | can |
|---|---|
| Table ADMIN | Mark columns masked and write column rules in roles. |
| Role member with Visible | Reveal values, each reveal recorded. |
| Role member with Masked or Hidden | See the mask, or nothing. |
-- faq
Questions about column masking and hidden columns
Are masked columns encrypted?
Yes. Values in a masked column are stored encrypted, and decrypting them for a reveal is recorded in the access log.
Can I still filter on a masked column?
With equality only, and only if your role can see it. Ranges and text search such as LIKE are not available on masked columns.
What is the difference between masked and hidden?
Masked shows that the column exists but replaces its value; hidden removes the column from the schema and results for that person.
100% customizable, code and all
Make AutessaDB fully your own.
Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.
Start free and make it yours