1"use strict";(self.webpackChunkdoc=self.webpackChunkdoc||[]).push([[63],{3905:(e,t,r)=>{r.d(t,{Zo:()=>u,kt:()=>m});var n=r(7294);function a(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function o(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function i(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?o(Object(r),!0).forEach((function(t){a(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):o(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(r,t))}))}return e}function c(e,t){if(null==e)return{};var r,n,a=function(e,t){if(null==e)return{};var r,n,a={},o=Object.keys(e);for(n=0;n<o.length;n++)r=o[n],t.indexOf(r)>=0||(a[r]=e[r]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(n=0;n<o.length;n++)r=o[n],t.indexOf(r)>=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(a[r]=e[r])}return a}var s=n.createContext({}),l=function(e){var t=n.useContext(s),r=t;return e&&(r="function"==typeof e?e(t):i(i({},t),e)),r},u=function(e){var t=l(e.components);return n.createElement(s.Provider,{value:t},e.children)},p={inlineCode:"code",wrapper:function(e){var t=e.children;return n.createElement(n.Fragment,{},t)}},d=n.forwardRef((function(e,t){var r=e.components,a=e.mdxType,o=e.originalType,s=e.parentName,u=c(e,["components","mdxType","originalType","parentName"]),d=l(r),m=a,y=d["".concat(s,".").concat(m)]||d[m]||p[m]||o;return r?n.createElement(y,i(i({ref:t},u),{},{components:r})):n.createElement(y,i({ref:t},u))}));function m(e,t){var r=arguments,a=t&&t.mdxType;if("string"==typeof e||a){var o=r.length,i=new Array(o);i[0]=d;var c={};for(var s in t)hasOwnProperty.call(t,s)&&(c[s]=t[s]);c.originalType=e,c.mdxType="string"==typeof e?e:a,i[1]=c;for(var l=2;l<o;l++)i[l]=r[l];return n.createElement.apply(null,i)}return n.createElement.apply(null,r)}d.displayName="MDXCreateElement"},4826:(e,t,r)=>{r.r(t),r.d(t,{assets:()=>s,contentTitle:()=>i,default:()=>p,frontMatter:()=>o,metadata:()=>c,toc:()=>l});var n=r(7462),a=(r(7294),r(3905));const o={},i="Column Level Security",c={unversionedId:"data-privacy/cls",id:"data-privacy/cls",title:"Column Level Security",description:"Column Level Security (CLS) is a data security measure that provides fine-grained control over access to specific columns of a database table. With CLS, database administrators can restrict access to sensitive data by allowing only authorized users or roles to access specific columns. This helps to protect against data leaks or unauthorized access to sensitive information.",source:"@site/docs/data-privacy/cls.mdx",sourceDirName:"data-privacy",slug:"/data-privacy/cls",permalink:"/docs/data-privacy/cls",draft:!1,editUrl:"https://github.com/Canner/vulcan-sql/tree/main/packages/doc/docs/data-privacy/cls.mdx",tags:[],version:"current",frontMatter:{},sidebar:"tutorialSidebar",previous:{title:"Dynamic Data Masking",permalink:"/docs/data-privacy/data-masking"},next:{title:"Row Level Security",permalink:"/docs/data-privacy/rls"}},s={},l=[],u={toc:l};function p(e){let{components:t,...r}=e;return(0,a.kt)("wrapper",(0,n.Z)({},u,r,{components:t,mdxType:"MDXLayout"}),(0,a.kt)("h1",{id:"column-level-security"},"Column Level Security"),(0,a.kt)("p",null,"Column Level Security (CLS) is a data security measure that provides fine-grained control over access to specific columns of a database table. With CLS, database administrators can restrict access to sensitive data by allowing only authorized users or roles to access specific columns. This helps to protect against data leaks or unauthorized access to sensitive information."),(0,a.kt)("p",null,"In the VulcanSQL system, CLS can be achieved by utilizing if-else conditions in conjunction with user attributes, which are accessible through ",(0,a.kt)("inlineCode",{parentName:"p"},"{{ context.user.attr }}")," in VulcanSQL. For instance, to limit access to the salary column in the employees table, you may use the following query:"),(0,a.kt)("pre",null,(0,a.kt)("code",{parentName:"pre",className:"language-sql"},"SELECT\n employee_id,\n first_name,\n last_name,\n {% if c
1ontext.user.attr.department == 'intern' %}\n NULL AS salary\n {% else %}\n salary\n {% endif %}\nFROM\n employees;\n")),(0,a.kt)("p",null,"Additionally, you can refer to the ",(0,a.kt)("a",{parentName:"p",href:"./data-masking"},"Dynamic Data Masking")," section to learn how to effectively mask sensitive information."))}p.isMDXComponent=!0}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.