Masking Exemption
Masking precedence: Masking Exemption > Global Masking Rule > Column Masking.
Certain roles can grant masking exemption to the users to access the unmasked data:
- Built-in roles:
Workspace Admin
,DBA
,Project Owner
. - Custom roles:
bb.policies.create
,bb.policies.update
,bb.policies.delete
.
To grant masking exemption:
-
Go to the project, click Manage > Masking Exemptions.
-
Click Grant Exemption. You can grant either
Export
orQuery
exemption. -
Select the user/groups and the database/table, and click Confirm.
You can't grant masking exemption to the service account. Because the intended use is to exempt human users from the masking policy when they query from SQL Editor.