The trust center states the policies. This page is the operational side: how roles and attribute rules are written, how masking behaves, how the audit log is exported, how secrets are referenced, and what the network needs.
A role says what a person, pipeline or agent may do: read a catalog domain, run a pipeline, approve a write. An attribute rule filters rows and masks columns by attributes of the identity: customer = identity.partner_id lets a partner see only its own shipments; region in identity.regions scopes a planner to their plants. Rules are written once and apply to questions, dashboards, pipelines and agents alike.
A masked column is shown as blocked or partially hidden, and the answer says why: 'revenue blocked by policy'. Masking applies before an answer is composed and before a load writes a target, so a copy never carries what the reader may not see.
Every query, load, write and approval is an append-only record with the identity, the time, the object and the outcome. Records are exported by API or landed in your warehouse on a schedule; the write ledger is a view of the same record.
Credentials live in the vault and are referenced by name. Rotation is a vault operation; connections re-test automatically after it.
| System | Path |
|---|---|
| SAP | PrivateLink from your cloud, or a VPN, or a jump host agreed with Basis; ports for RFC and, where used, OData. |
| Oracle and databases | Private link or VPN; the database port; a read-only user. |
| Object storage and warehouses | Private endpoints where the provider offers them; keys or roles. |
| User interface and API | HTTPS through the web application firewall; your identity provider for sign-in. |
The trust center: policies, the extraction statement, the write-back audit model, certifications →
