Tag-Based Masking

Tag-based masking applies masking rules to every column that carries a matching tag, rather than to a single column named individually. On Snowflake, the tag is a Snowflake Object Tag; on Databricks, it’s a Unity Catalog Tag. When a column carries a tag value a rule targets, the rule applies to that column.

ALTR recommends tag-based masking over column-based masking for most cases:

• Scalability — a tag-based policy covers every column carrying its tag as new columns are tagged, while a column-based policy needs a separate rule per column.
• Resilience to schema changes — a tag-based policy continues to apply if a column is renamed, while a column-based policy hardcodes the column’s name and location at creation and goes stale on rename or clone (see the Caution on Column-Based Masking).
• Interoperability — tag-based masking works with third-party classification tools and metadata/catalog sources that write to the same Snowflake Object Tag or Unity Catalog Tag mechanism.

For masking targeted at one specific column instead of every column carrying a tag, see Column-Based Masking.

Matching by Tag Name or Tag Value

A tag-based policy rule matches columns one of two ways:

• Tag name applies one masking rule to every column carrying the tag, regardless of its value. Use this for broad, tag-level policies — for example, one rule applies to every column tagged pii=name, pii=email, or any other pii= value.
• Tag name and value applies masking to a specific tag value, matched exactly (no wildcard matching), so a single tag can carry different rules for different values. Use this for more granular policies — for example, a different masking type for columns tagged pii=name than for columns tagged pii=email.

Create a Tag Policy

To create a tag-based policy:

1. Ensure the tag is connected to ALTR.
2. Select Policy in the navigation menu.
3. Click Create Policy.
4. Locate the Tag Policy card and click Create Policy.
5. Select the Tag Name the policy affects. The policy applies its masking rules to all columns carrying this tag.
6. Click Next.
7. Build the rule statement:
   1. Select the Role the rule applies to.
   2. Choose Tag name or Tag name and value to set how the rule is matched.
   3. Select the Masking Type — the masking type applied to query results for that role. See Masking Types for the available masking types and how ALTR resolves overlapping rules.
8. (Optional) Click Add an Alert to configure a policy alert for this rule. See Policy Alerts.
9. (Optional) Click + Rule Statement to add another rule to the policy.
10. (Optional) Disable Policy State to save the policy inactive and activate it later. To deactivate a policy after it’s created, first resolve all of its alerts. Deactivating a policy stops applying its masking rules to your data.
11. Click Save. ALTR saves the policy.

Edit a Tag Policy

To edit a tag policy:

1. Select Policy in the navigation menu.
2. Expand the policy to edit.
3. Click Edit Policy.
4. Update the policy as needed.
5. Click Save. ALTR saves your changes.

Delete a Tag Policy

Deleting a tag policy removes its masking rules; columns are no longer masked for the roles and tag values the policy covered. This removes the policy from ALTR only — it does not remove the tag itself from Snowflake or Databricks.

To delete a tag policy:

1. Select Policy in the navigation menu.
2. Expand the policy to delete.
3. Click Edit Policy.
4. Click Delete Policy; a confirmation modal displays.
5. Click Delete Policy to confirm.

Note

Connecting a tag to ALTR — including the Snowflake protection-type choice (default masking, pushdown, tokenization, or Format-Preserving Encryption), Databricks Metastore selection, and the ALTR_HOOK_POST and ALTR_ROLE_SET custom functions — is covered on Data Masking on Snowflake and Data Masking on Databricks.