Redaction Policies
A redaction policy masks the values of designated columns for specified users and groups. A support agent can see that a customer row exists and which columns it has, but an email or account number comes back partially or fully starred out. Redaction is applied on the same governed execution path as every other Colrows query.
Access control vs. redaction
These are two different controls, and you'll often use both:
| Access control | Redaction | |
|---|---|---|
| What it decides | Whether a row or column can be queried at all | Whether a column's values are shown in the clear |
| Effect on the result | Rows are filtered out; columns outside the persona's subgraph don't exist | The row and column are present; the value is masked |
| When it runs | At compile time - unauthorized plans are never generated | On the returned rows, after access is granted |
Redaction assumes access has already been granted and reduces how much of a value is disclosed.
What a policy contains
- Scope - one datasource, optionally a schema, within your organization.
- Columns - the fields to mask.
- Masking style - full (the whole value starred), keep first N characters, or keep last N characters. Non-text values return a fixed mask token.
- Targets - the users and/or user-groups the policy applies to. Everyone else sees the real values.
- Rules - policies can be defined as fixed column rules or as regex-based rules, and are versioned like other governed definitions.
Manage via API
Redaction policies are managed in Administration → Redaction Policies, and on the platform API:
| Operation | Endpoint |
|---|---|
| Create a policy (admin) | POST /api/redaction/create |
| Update a policy (admin) | PUT /api/redaction/update |
| Get a policy (all versions) | GET /api/redaction/get/{policyId} |
| Get a specific version | GET /api/redaction/list/{policyId}/{version} |
| List policies | GET /api/redaction/list |
| Delete a policy (admin) | DELETE /api/redaction/delete/{policyId} |
Masking a value (hash or partial) keeps a stable, non-disclosing key so downstream joins and metrics still work - where an outright column denial would break them. Pair redaction with access control for full coverage.