Request a Demo
OverviewCapabilitiesData qualityDomain catalogueBy roleBy industryCompareMigrateOutcomesResources
Docs Master data

Security and roles

The twelve layers, policies by role and by attribute, purpose windows and certification.

All master-data docsRequest access to the full tier
OverviewData modelGolden-record APIMatch and survivorshipHierarchies APIData servicesRules languageSecurity and rolesAudit and historyPivots and measures APIQuality agents and packs

The twelve layers

Identity and SSO; tenant; source authorisation passed through; domain; table or entity; hierarchy branch; row filter; column read; column write; column delete; cell mask; purpose and time window. Evaluated in order; the first refusal wins; refusals are logged with the layer and the policy.

Policies

policy treasury_bank_full
  role treasury
  domain supplier  table bank_account
  columns iban: read, write; bic: read
  rows company_code in ('1200', '1300')
  mask none
  purpose required for iban read, window 30 min

policy analytics_masked
  role analytics
  domain supplier  columns iban: read masked(last4)  credit_limit: read banded

Certification

The matrix per role is reviewed quarterly and signed; the signature is a ledger entry. Attribute-based policies (sensitivity, region, company code, lifecycle) cover new records the moment they exist.