Column-Level Security (CLS)

This tutorial demonstrates how to protect sensitive information in your datasets while still enabling high-level analysis on the unmasked columns within a row. You will learn how to configure Column-Level Security (CLS) to mask specific values based on user attributes.

Configure CLS

Follow these steps to configure CLS:

1. Navigate to the Data Sources tab in your project.
2. Select the table you wish to modify (e.g., Account).

3. Ensure that Show advanced options is toggled on in the top-right corner.
4. Locate your sensitive column and click Configure under the CLS Masking column.

5. In the Column-Level Security modal, provide a SQL expression that determines how the data is displayed at query time.

6. Click Save. The status badge in the CLS Masking column will now show as Active.

If you enter an incorrect value, such as a column name that doesn’t exist, the system will alert you to the error and will not let you save it.

Verifying the Implementation

Once active, CLS functions as a global security layer. It automatically enforces your masking logic across WisdomAI Chat, Dashboards, the SQL Playground, and Data Source Previews.

For unauthorized users, protected data will appear as hashed values. It is important to remember that CLS is applied strictly at the column level.

Avoid Data Leakage: If you protect a column (e.g., Customer Name) but leave a correlative column unprotected (e.g., Customer Email), an unauthorized user will see the hashed name, but the clear-text email address. Ensure you apply masking to all columns that could potentially identify the sensitive entity.

Next Steps

Users Management

Manage user roles, permissions, and access to the platform.

Basic Tutorial: Connect and Test

Walk through the initial setup to connect a data source and run your first query.