Policy Exception

Overview

When an Unmasking Request submitted via Workflow is approved, the details of this approval are listed in the Policy Exception section (found under Databases > Policies > Policy Exception). This list allows administrators and relevant users to review and confirm the exceptions that have been made to existing data masking policies.

Items in the Policy Exception List

1. Connection: Displays the name of the database connection to which the unmasking exception applies.

2. Data Path: Displays the specific path of the data for which the unmasking exception is applied. The format varies by database type:

   1. Example 1 (MySQL): Database > Table > Column

   2. Example 2 (Oracle): Database > Schema > Table > Column

   3. Example 3 (DynamoDB): Table > Column

3. Allowed Users: Displays the username(s) of the user(s) for whom the policy exception (unmasking) is applied.

4. Start Time: Displays the time from which the policy exception becomes active.

   1. For standard Unmasking Requests, this is typically the time the request was approved.

   2. If the request was registered using post-approval (urgent mode), this is typically the time the request was submitted.

5. End Time: Displays the time when the policy exception will no longer be active. This is determined by the "Unmasking Expiration" setting specified in the original Unmasking Request:

   • If the "Unmasking Expiration" type was set to a specific "End Date," that date and time will be displayed as the End Time.

   • If the "Unmasking Expiration" type was set as a "Time Duration" (e.g., 10 minutes, 1 hour), the End Time is calculated by adding this duration to the Start Time.

6. Status: Indicates the current state of the policy exception. Possible statuses are:

   • Active: The policy exception is currently applied as a result of an approved unmasking request, and the data is displayed unmasked for the allowed user(s). This status can be manually changed to Inactive before the End Time is reached.

   • Inactive: The policy exception has been manually deactivated (even if the original unmasking request was approved), and the data is displayed as masked according to the original policy. This status can be manually changed back to Active before the End Time is reached.

   • Expired: The End Time for the unmasking request has passed. The data is now masked according to the original policy, and the status cannot be changed back to Active or Inactive.

7. Excepted By: Displays a link to the Unmasking Request that initiated this specific policy exception. Clicking this link will redirect you to the detailed view of that request within the "All Requests" section of the Workflow.