Row Access Policies

Row Access Policies in TrustLogix enable organizations to enforce fine-grained access control by restricting data access at the row level based on user attributes, roles, or predefined conditions. This document details how to create a row access policy and includes all available options in dropdown menus.

The Condition Builder simplifies policy creation for non-technical users, while the SQL Builder offers advanced customization for precise control over data masking rules.

Steps to Create a Row Access Policy

Navigate to the Row Access Policy Configuration

• Log in to TrustLogix.

• Click on Data Sources.

• Select the relevant Data Source (e.g., Healthcare Services).

• Click on Access Policies.

• Click Create Policy.

Define Row Access Policy Details

• Enter the Policy Name (e.g., Grant_Patient_info_By_Assigned_State).

• Provide a Policy Description (e.g., Grant all patient data to user based on assigned state).

• Click Next.

Select Data Scope

• Choose Named As or Classified As.

• Click Tags and enter classification keywords (e.g., SENSITIVE, CONFIDENTIAL).

• Select the Schema/Table to apply the policy (e.g : HEALTH_CARE.PATIENT_SCHEMA.PATIENT)

• Click Close after selecting the objects.

Define Access Conditions

• Click Use SQL Editor or Use Condition Builder.

• Click Add Condition.

• The Attribute drop down will list all available principal type options along with entitlement attributes.

• Choose one of the option based on the condition wanted to be built.

• Select the appropriate operator (Equals, Not Equals, Contains, Starts With).

• Based on the attribute chosen Match with drop down will show up with available option

• Choose the option from the Match with drop down. Value option will be provided with additional options based on selected Match with option

• Select or enter the value

• Click Add Condition or Add Nested Condition to add multiple criteria.

• Click on Save

• Modal window popup to show policy generation progress. If there are no errors policy is created and ready to be deployed

• If required, review and update conditions before deployment.

• If there are any validation error due to duplicate policy or column conditions mismatch correct them get the policy created and ready to be deployed

• Click on Deploy button to deploy the policy from the modal.

• Click Use Condition Builder or Use SQL Editor.

Save and Deploy the Policy

• Click Save to store the policy.

• Click Deploy to enforce the policy across the selected data sources.

Condition Builder Options:

• User-friendly interface for defining access conditions without requiring SQL knowledge.

• Attribute Selection:

  • Role Name

  • User Group

  • Department

  • Geographical Region

  • Country

Attributes drop down will list all the attributes created under attribute management screen for this data source

• Operators:

  • Equals

  • Not Equals

  • Contains

  • Starts With

  • Ends With

  • In List

  • Not In List

• Logical Operators:

  • AND

  • OR

  • Nested Conditions

• Value Assignment:

  • Static values (e.g., USA, EU, APAC).

  • Dynamic values based on user attributes.

Advantages:

• User-friendly interface for defining access conditions without having SQL Knowledge.

• Allows nested conditions for complex policies.

• Provides drag-and-drop options to select attributes, operators, and values.

• Best suited for non-technical users who prefer a guided configuration.

• Supports logical operators like AND, OR, and grouping conditions.

SQL Editor Options:

• Advanced tool for writing custom conditions in SQL syntax.

• Allows for:

  • Fine-grained control over policy conditions.

  • Using JOINs, subqueries, and complex expressions.

  • Applying row-level security based on dynamic queries.

• Example Query:

SELECT * FROM HEALTH_CARE.PATIENT_SCHEMA
WHERE STATE IN (SELECT STATE FROM USER_ATTRIBUTES WHERE USER_ID = CURRENT_USER());

Advantages :

• Advanced tool for writing custom conditions in SQL syntax.

• Allows fine-grained control over policy conditions.

• Supports JOINs, subqueries, and complex expressions.

• Best suited for technical users familiar with SQL.

• Provides query validation to ensure correctness before applying conditions.