Identifiers

Overview¶

An Identifier is a reusable, named selection of users, columns, or rows that you define once and reference wherever you author a policy — a single update to an Identifier takes effect everywhere it's used, instead of re-listing the same values in every policy.

There are three kinds of Identifier: User, Column, and Record. Build a library of Identifiers ahead of time, then search and select them as you create policies.

Identifier types¶

User Identifier¶

A User Identifier selects a set of users, roles, or groups. You write a query that describes the users you want to govern.

Examples:

• Users in the United States, using the user's country attribute: USER.country == 'US'.
• Employees in California, using the userType and state attributes: USER.userType == 'EMPLOYEE' && USER.state == 'California'.
• Members of a group, such as HR: IS_IN_GROUP('HR').
• Users with a role, such as Admin: IS_IN_ROLE('admin').
• Several groups at once: IS_IN_GROUP('HR') || IS_IN_GROUP('Accounts').
• HR members who are also in the US: IS_IN_GROUP('HR') && USER.country == 'US'.

Column Identifier¶

A Column Identifier selects columns, either by the tags they carry or by name. Selecting by tag is the common choice, because it follows your classification rather than specific column names. You pick tags from the Select Tags option and the Identifier builds the query for you, so you don't have to write HAS_TAG('<tagName>') manually.

Examples:

• Email addresses, such as the column email_address, tagged EMAIL: HAS_TAG('EMAIL').
• A specific column by name, using the resource's column property: RES.column == 'email_address'.
• Email columns by tag or by name: HAS_TAG('EMAIL') || RES.column == 'email'.
• Several tags at once: HAS_TAG('EMAIL') || HAS_TAG('SSN').

Record Identifier¶

A Record Identifier selects rows using a filter you define for each service, such as privacera_snowflake, privacera_databricks_unity_catalog, or privacera_bigquery. Because the filter is written per service, a Record Identifier applies only to resources of a service you have defined a rule for.

Examples:

For a privacera_snowflake rule, name the column directly:

• Only rows where country is US: obj.country = 'US'.
• Only rows where region is US-West: obj.region = 'US-WEST'.
• Only rows where status is active: obj.status = 'ACTIVE'.

A filter can also find the column by its tag instead of naming it, using a macro (a built-in function that resolves dynamically at query time), so the rule keeps working as columns change. See ABAC Macros for the full list, or Dynamic Tag Macros for RLF Policies for details on this one.

• Only rows inside Texas, using the column state_name tagged STATE: obj.${{TAG_GET_CHILD_RES('STATE')}} = 'TX'.

For a privacera_databricks_unity_catalog rule, each user can see only their own region, using the user's region attribute:

• obj.region = '${{USER.region}}'.

Writing a custom query¶

When you write a query directly for a User or Record Identifier, or pick Custom for a Column Identifier, you build a free-form expression from these parts. The same parts work for every Identifier type.

• Comparisons: for User Identifiers, compare a value with ==, or exclude one with !=, such as USER.country == 'US'. For Record Identifiers, use = to compare a value, and NOT to exclude one, such as country = 'US' or NOT country = 'US'.
• Attributes: USER.<attribute> references a value stored on the user, such as USER.country or USER.region; RES.<property> references the resource's metadata, such as RES.column or RES.table.
• Group and role functions: IS_IN_GROUP('HR') and IS_IN_ROLE('admin') select users by their group or role.
• Value lists (Record Identifiers only): allow any of several values with IN, such as region IN ('US-WEST', 'US-EAST').
• Regex: match a pattern of values rather than a single literal value. For example, the schema name must start with ca_ (such as ca_sales, ca_hr, ca_finance) for a user who must be an EMPLOYEE: USER.employeeType == 'EMPLOYEE' && /^ca_.*/.test(RES.schema).
• Combine (User Identifiers only): join conditions with || for or and && for and, such as IS_IN_GROUP('HR') && USER.country == 'US'.

Manage Identifiers¶

Open Settings → Identifiers (under Classification & Metadata) in the left sidebar. The Identifiers page lists every Identifier with its name, description, type, and last-updated time. From this page you can:

• Search by name.
• Filter by Identifier Type: All, User, Column, or Record.
• Sort By name, last modified, or created date.
• Toggle between a card grid and a list view using the icons in the top-right corner.
• Create Identifier to open the editor.
• Use a card's ⋮ menu to Edit, Clone, or Delete an Identifier.

Create an Identifier¶

Create Identifiers from the Identifiers page to build a reusable library; policies then reference them.

1. On the Identifiers page, click Create Identifier.
2. Enter a Name.
3. Optionally, enter a Description.
4. Select a Type: User, Column, or Record. The fields below depend on the type:
   • User Identifier: enter a Custom Query that describes the users to govern.
   • Column Identifier: choose a Query source. Pick Tags and use Select Tags to choose one or more tags, or pick Custom to write a query.
   • Record Identifier: add one or more rules, each with a Service and a Query. A service already used by another rule is not offered again.
5. Use the Preview pane to check the resulting rules as you build them.
6. Click Create Identifier.

Edit an Identifier¶

Open an Identifier from the Identifiers page, or from its ⋮ menu, to update its fields and rules, then click Save. Because Identifiers are reusable, a change applies everywhere the Identifier is referenced — the editor shows the policies that reference the Identifier and the number of resources they affect, so you can review the impact before saving.

Delete an Identifier¶

Delete an Identifier from its ⋮ menu on the Identifiers page, or with Delete Identifier in the editor. A Confirm Delete dialog appears, and deletion cannot be undone.

Related topics¶

• Tags and Metadata