How do I enforce row filters and column masking when the data lives in different systems?

In SemanticFed[1], you enforce row filters and column masking centrally at the federation edge rather than re-implementing disparate permission schemes inside each individual database, warehouse, or API.

The workflow operates as follows:

1. Define an Access Policy: In the Policies console, create a policy and specify its effect as ALLOW or DENY (Row- and Column-Level Security[2]).
2. Configure the Scope:

• ROW: Set a dynamic row filter predicate (for instance, restricting salespeople to records matching their assigned region).
• COLUMN: Apply column masking to redact, hash, or restrict sensitive fields like PII unless explicit access is granted.
• ENTITY: Restrict or allow access to an entire object or model.

3. Attach Principals and Models: Bind the policy to your governed entities or models and assign the target roles or groups managed via platform RBAC (SemanticFed Security[3]).
4. Edge Enforcement: When users, tools, or agents run federated queries across multiple data sources, the query engine evaluates the unified policy and applies row filtering and masking before results are returned.
5. Audit and Verify: Inspect query plans and audit logs to see which policies were evaluated and trace data lineage back to physical source systems.

To explore this setup in detail, visit the Row- and Column-Level Security use case[2] or join the SemanticFed waitlist[4].