Overview
DataBuddy provides a "Tag → Policy" linkage mechanism: after a masking policy is associated with a sensitive governance tag, all fields with that tag automatically inherit the policy, eliminating the need for manual field-by-field configuration. This document describes how to associate a masking policy with a sensitive tag, how fields inherit policies, the linkage rules when a policy is replaced or unbound, and how to check for tags without associated policies in the governance tag list.
This mechanism aims to bring "sensitive identification" and "masking control" onto the same data: identify once, associate once, and take effect automatically.
Prerequisites
You have activated the DataBuddy service and completed workspace initialization.
You have created the required masking policies in Data Security > Masking Policies. For details, see Column-Level Access Control.
The current account has edit permission on the target sensitive tag. For system tags, authorized users can also update the associated policies.
Use Limits
|
Sensitive Tags Only | Only sensitive tags can be associated with masking policies; business tags do not have this capability. |
One-to-One Association | A sensitive tag can be associated with only one masking policy at a time. |
Policy Source | The associated policy must already exist in masking policies; you can click the + Create Masking Policy → entry in the dialog to create one and then return to this process. |
System Tags | The names, descriptions, and types of system sensitive tags are read-only, but associated masking policies can still be modified by authorized users. |
Inheritance Scope | A field inherits a policy from a tag only when the field is actually tagged with that sensitive tag. |
Operation Steps
Step 1: Associating a Desensitization Policy in Tag Governance
The most convenient way to associate a policy with a newly created sensitive tag is to configure it directly when the tag is created. You can also bind a policy later in the tag details.
Method A: Configure once when creating a sensitive tag
1. On the Data Catalog > Tag Management > Sensitive Tag Tab, click + Create Sensitive Tag.
2. In the pop-up window, locate the Associated Masking Policy drop-down list under Sensitive Classification Configuration:
Select an existing policy from the drop-down list to associate it directly.
Select Do Not Associate. You can configure it later in the tag details.
Click + Create Masking Policy at the bottom of the drop-down list to go to the Masking Policy Tab and create a new policy. After creation, return to the Sensitive Tag Tab to continue.
3. Click OK to complete.
Method B: Add or change associations on an existing tag
1. In the sensitive tag list, locate the target tag (system or custom).
2. Open the tag details through one of the following entries:
Click the tag name in the Name column.
In the Masking Policy column, unassociated tags display "⚠️ Associate". Click it to open the details pop-up and automatically focus on the Associated Masking Policy section.
3. In the Select Target Masking Policy section of the details pop-up:
4. Click Save to complete. The system will synchronously refresh the policies inherited by all fields that have been tagged with this tag.
Tip
The + Create Masking Policy entry closes the current details pop-up, switches to the Masking Policy Tab, and opens the Create Policy pop-up. After the new policy is created, return to the Governance Tag Tab, reopen the details pop-up for this tag, and then select the newly created policy.
Step 2: Replacing or Unbinding the Policy Associated with a Tag
Change Policy:
1. In the sensitive tag details, switch the associated policy to a new policy and save.
2. All fields with "Tag Inheritance" are automatically switched to the new policy. Fields with manually specified policies are not affected.
Unbind Policy:
1. In the Associated Masking Policy section of the sensitive tag details, click Unbind and save.
2. All fields with "Tag Inheritance" under this tag will lose their masking policy. The Masking Policy column reverts to empty, and the fields are no longer masked.
3. In the Masking Policy column of the governance tag list, the tag reverts to the "⚠️ Associate" state.
Note:
Unbinding causes fields to immediately lose masking. Prepare a replacement policy in Masking Policy in advance, or manually configure a policy for the affected fields before unbinding to prevent sensitive data from being returned in plaintext.
Step 3: Reverse Linkage on the Desensitization Policy Side
When a policy is deleted in Data Security > Masking Policy, governance tags are updated accordingly:
1. After a policy is deleted, the Masking Policy column for all sensitive tags originally associated with the policy reverts to "⚠️ Associate".
2. Fields that inherit policies through these tags will simultaneously lose masking.
3. In the masking policy details, you can reverse-view which sensitive tags are associated with the policy and which fields are affected by these tags, making it easier to assess the impact before deletion.
Step 4: Inventorying Sensitive Tags Without Associated Policies
In the Sensitive Tags Tab, you can quickly identify sensitive tags that already exist but are not yet associated with a masking policy, thereby closing the "tagged but not masked" gap.
1. In the sensitive tag list, filter by the Masking Policy column for "Unassociated".
2. The list displays all sensitive tags whose Masking Policy column is "⚠️ Associate".
3. Go to each detail page and associate the policy using method B described in Step 1.
Parameter Description
Associated Desensitization Policy Fields for Sensitive Tags
|
Associate Masking Policy | The masking policy bound to this sensitive tag; select an existing policy from the dropdown list, or select "Not Associated". | No | Not associated |
Editable Fields in the Tag Details Pop-up
|
Tag name | Read-Only | Read-only (cannot be renamed after creation). |
Type | Read-Only | Read-Only |
Description | Read-only (system-provided descriptions in both Chinese and English). | Editable |
Security Regulations | Read-Only | Editable |
Associate Masking Policy | Editable | Editable |
Verification Result
After the operation is completed, you can confirm in the following ways:
1. In the sensitive tag list, the Masking Policy column of the target tag already displays the bound policy name.
2. Go to any table that has been tagged with this sensitive tag. The Masking Policy column of the corresponding field already displays the policy name.
3. When an authorized user queries this field, the returned result is masked according to the policy rules. The specific behavior is subject to the policy definition.
FAQs
Q: Can a sensitive tag be associated with multiple desensitization policies?
A: Not supported. A sensitive tag can be associated with only one masking policy at a time. If you have multiple masking requirements (for example, different rules for external queries and internal analysis), we recommend that you split them into multiple sensitive tags and associate each tag with a different policy.
Q: Can a field be associated with multiple sensitive tags at the same time?
A: Not supported. A field can be associated with only one sensitive tag at a time.
Q: Can desensitization policies also be attached to business tags?
A: No. Masking policy association is a capability exclusive to sensitive tags. Business tags are used for business classification and asset filtering, and do not participate in masking control.
Q: Do sensitive tags applied via natural language in Buddy also inherit desensitization policies?
A: Yes. Tagging triggered by Buddy and manual tagging use the same data path. As long as the sensitive tag is associated with a masking policy in the governance tags, the field automatically inherits the policy.
References
Column-Level Permission Control