Automatic Tagging

Automatic tagging applies Snowflake Object Tags or Databricks Unity Catalog tags to columns based on a completed classification report, turning classification’s findings into tags a tag-based masking or column-based masking policy can act on. Without tagging, a classification report is informational only.

Automatic tagging works with classification reports from ALTR Native and Google DLP classifiers, plus legacy Snowflake Native classifications; classifier name matching is case-insensitive. Automatic tagging supports Snowflake and Databricks. There’s no equivalent for OLTP databases, which have no native column-tagging mechanism ALTR can write to.

Note

Automatic tagging applies tags directly from the classification report, with no step to accept, reject, or correct individual matches at tagging time. To review matches before they reach the report, run the classification job with Human-in-the-Loop Review. If a false positive does reach the report, remove the resulting tag manually in Snowflake or Databricks.

Priority

A column can match more than one classifier — for example, a column of city names might match both a location classifier and a name classifier. Each mapping in the JSON object carries a priority number that resolves this: the mapping with the lower number takes priority over one with a higher number for the same column.

Write the JSON Mapping

To map classifiers to tags, write a JSON array of mapping objects. Each object specifies where the tag lives (its database, schema, name, and value) and lists the classifiers that trigger it, along with its priority:

[
  {
    "tag_database": "<TAG_DATABASE>",
    "tag_schema": "<TAG_SCHEMA>",
    "tag_name": "ALTR Classification",
    "tag_value": "Social Security Number",
    "priority": 1,
    "classifiers": [
      "ALTR Managed - US Social Security Number"
    ]
  }
]

The "classifiers" array in each mapping lists the values that trigger it: normally the classifier’s name exactly as it appears in the classification report (for example, "ALTR Managed - US Social Security Number"). For a Google DLP result, use the matched infoType constant instead (for example, "US_SOCIAL_SECURITY_NUMBER"); for a legacy Snowflake Native result, use the semantic category value prefixed SEMANTIC_CATEGORY: (for example, "SEMANTIC_CATEGORY:EMAIL"). Find the exact value to use by opening the classification report and copying the classifier name, infoType, or semantic category shown there.

Find your tag’s database and schema (for example, by running SHOW TAGS in Snowflake); if you’re creating a new tag, use the database and schema where you want ALTR to create it. Only classifiers included in the selected classification report can be mapped.

Note

Each platform caps how many tags a table or column can carry. On Snowflake, the limit is 20 tag names per table; ALTR reserves headroom for its own tags, so a tagging job fails if the table already carries more than 18.

Trigger a Tagging Job

To trigger a tagging job:

1. Select Data Classification > Classification Reports in the navigation menu.
2. Select the classification report to tag.
3. Click Tag Columns.
4. Enter your JSON mapping object.
5. (Optional) Turn on Create Tags to have ALTR create any mapped tags that don’t already exist. The service user needs privileges to create and apply the tag in your platform’s tagging system: on Snowflake, that’s CREATE TAG and USAGE on the schema where the tag will reside, plus APPLY TAG to apply it, and OWNERSHIP of an existing tag if you’re adding new allowed values to it.
6. Click Tag Columns. ALTR runs the tagging job; large reports can take several minutes to hours to complete.

Note

Only one tagging job can run at a time per data source.

View and Download the Tagging Summary

Once a tagging job completes, ALTR generates a summary showing which columns were tagged and which failed: typically because a mapped tag doesn’t exist, a classified column no longer exists, your JSON has an error, or the service user lacks the privileges to create or apply the tag.

To view the tagging summary:

1. Select Data Classification > Classification Reports in the navigation menu.
2. Select the classification report.
3. Click View Tagging Summary.

Click Download JSON Report from the same page to save the summary as a JSON file.

Locate the Tracking ID

If a tagging job fails and you contact ALTR Support, include the job’s Tracking ID in your message.

To locate the Tracking ID:

1. Select Data Classification > Classification Reports in the navigation menu.
2. Select the classification report.
3. Click View Tagging Summary.
4. Copy the Tracking ID.

Note

ALTR includes the Tracking ID automatically when you contact ALTR Support directly from a failed tagging job’s notification.

Example Mappings

The following mappings illustrate different tagging strategies. Replace <TAG_DATABASE> and <TAG_SCHEMA> with the database and schema where each tag lives (or where you want ALTR to create it).

Stoplight Sensitivity (Google DLP)

A three-tier model (red, yellow, green) for organizations that want a lightweight tag structure without one tag per classifier:

[
  {
    "tag_database": "<TAG_DATABASE>",
    "tag_schema": "<TAG_SCHEMA>",
    "tag_name": "ALTR Stoplight Policy",
    "tag_value": "Red",
    "priority": 1,
    "classifiers": [
      "CREDIT_CARD_NUMBER",
      "US_SOCIAL_SECURITY_NUMBER"
    ]
  },
  {
    "tag_database": "<TAG_DATABASE>",
    "tag_schema": "<TAG_SCHEMA>",
    "tag_name": "ALTR Stoplight Policy",
    "tag_value": "Yellow",
    "priority": 2,
    "classifiers": [
      "DATE_OF_BIRTH",
      "EMAIL_ADDRESS",
      "PHONE_NUMBER",
      "FIRST_NAME",
      "LAST_NAME",
      "PERSON_NAME",
      "MALE_NAME",
      "FEMALE_NAME",
      "LOCATION",
      "STREET_ADDRESS"
    ]
  },
  {
    "tag_database": "<TAG_DATABASE>",
    "tag_schema": "<TAG_SCHEMA>",
    "tag_name": "ALTR Stoplight Policy",
    "tag_value": "Green",
    "priority": 3,
    "classifiers": [
      "DATE",
      "GENERIC_ID",
      "COUNTRY_DEMOGRAPHIC",
      "US_STATE",
      "GENDER",
      "ORGANIZATION_NAME",
      "DOMAIN_NAME"
    ]
  }
]

Stoplight Sensitivity (Snowflake Native)

The same stoplight model, mapped from Snowflake Native semantic categories instead of Google DLP infoTypes:

[
  {
    "tag_database": "<TAG_DATABASE>",
    "tag_schema": "<TAG_SCHEMA>",
    "tag_name": "ALTR Stoplight Policy",
    "tag_value": "Red",
    "priority": 1,
    "classifiers": [
      "SEMANTIC_CATEGORY:BANK_ACCOUNT",
      "SEMANTIC_CATEGORY:NATIONAL_IDENTIFIER",
      "SEMANTIC_CATEGORY:TAX_IDENTIFIER",
      "SEMANTIC_CATEGORY:PAYMENT_CARD"
    ]
  },
  {
    "tag_database": "<TAG_DATABASE>",
    "tag_schema": "<TAG_SCHEMA>",
    "tag_name": "ALTR Stoplight Policy",
    "tag_value": "Yellow",
    "priority": 2,
    "classifiers": [
      "SEMANTIC_CATEGORY:DATE_OF_BIRTH",
      "SEMANTIC_CATEGORY:EMAIL",
      "SEMANTIC_CATEGORY:PHONE_NUMBER",
      "SEMANTIC_CATEGORY:NAME",
      "SEMANTIC_CATEGORY:STREET_ADDRESS"
    ]
  },
  {
    "tag_database": "<TAG_DATABASE>",
    "tag_schema": "<TAG_SCHEMA>",
    "tag_name": "ALTR Stoplight Policy",
    "tag_value": "Green",
    "priority": 3,
    "classifiers": [
      "SEMANTIC_CATEGORY:CITY",
      "SEMANTIC_CATEGORY:POSTAL_CODE",
      "SEMANTIC_CATEGORY:AGE",
      "SEMANTIC_CATEGORY:COUNTRY",
      "SEMANTIC_CATEGORY:GENDER"
    ]
  }
]

Google DLP infoTypes

Maps tags directly from Google DLP infoTypes, for organizations that want to tag and control access on the classification results as-is:

[
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "ALTR Classification", "tag_value": "Credit Card Number", "priority": 1, "classifiers": ["CREDIT_CARD_NUMBER"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "ALTR Classification", "tag_value": "Social Security Number (SSN)", "priority": 2, "classifiers": ["US_SOCIAL_SECURITY_NUMBER"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "ALTR Classification", "tag_value": "Date of Birth", "priority": 3, "classifiers": ["DATE_OF_BIRTH"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "ALTR Classification", "tag_value": "Email Address", "priority": 4, "classifiers": ["EMAIL_ADDRESS"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "ALTR Classification", "tag_value": "Phone Number", "priority": 5, "classifiers": ["PHONE_NUMBER"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "ALTR Classification", "tag_value": "Address", "priority": 6, "classifiers": ["LOCATION", "STREET_ADDRESS"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "ALTR Classification", "tag_value": "Name", "priority": 7, "classifiers": ["FIRST_NAME", "LAST_NAME", "MALE_NAME", "FEMALE_NAME", "PERSON_NAME"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "ALTR Classification", "tag_value": "Date", "priority": 8, "classifiers": ["DATE"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "ALTR Classification", "tag_value": "Gender", "priority": 9, "classifiers": ["GENDER"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "ALTR Classification", "tag_value": "Country", "priority": 10, "classifiers": ["COUNTRY_DEMOGRAPHIC"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "ALTR Classification", "tag_value": "State", "priority": 11, "classifiers": ["US_STATE"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "ALTR Classification", "tag_value": "Organization Name", "priority": 12, "classifiers": ["ORGANIZATION_NAME"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "ALTR Classification", "tag_value": "Domain Name", "priority": 13, "classifiers": ["DOMAIN_NAME"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "ALTR Classification", "tag_value": "Generic ID", "priority": 14, "classifiers": ["GENERIC_ID"] }
]

Financial and PCI Data (Google DLP)

For organizations tagging data that may be subject to Payment Card Industry (PCI) regulation:

[
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "PCI", "tag_value": "Primary Account Number (PAN)", "priority": 1, "classifiers": ["CREDIT_CARD_NUMBER", "CREDIT_CARD_TRACK_NUMBER"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "PCI", "tag_value": "Account Number", "priority": 2, "classifiers": ["FINANCIAL_ACCOUNT_NUMBER", "IBAN_CODE"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "PCI", "tag_value": "Cardholder Name", "priority": 3, "classifiers": ["PERSON_NAME"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "PCI", "tag_value": "Expiration Date", "priority": 4, "classifiers": ["DATE"] }
]

Healthcare and protected health information (PHI) Data (Google DLP)

Loosely modeled after HIPAA identifiers, for organizations tagging protected health information:

[
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "PHI", "tag_value": "HIPAA Identifier: Medical Record Number", "priority": 1, "classifiers": ["MEDICAL_RECORD_NUMBER"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "PHI", "tag_value": "HIPAA Identifier: Social Security Number (SSN)", "priority": 2, "classifiers": ["US_SOCIAL_SECURITY_NUMBER"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "PHI", "tag_value": "HIPAA Identifier: Taxpayer Identification Number (TIN)", "priority": 3, "classifiers": ["US_INDIVIDUAL_TAXPAYER_IDENTIFICATION_NUMBER", "US_PREPARER_TAXPAYER_IDENTIFICATION_NUMBER"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "PHI", "tag_value": "HIPAA Identifier: Medicare Beneficiary Number", "priority": 4, "classifiers": ["US_MEDICARE_BENEFICIARY_ID_NUMBER"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "PHI", "tag_value": "HIPAA Identifier: Phone Number", "priority": 5, "classifiers": ["PHONE_NUMBER"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "PHI", "tag_value": "HIPAA Identifier: Name", "priority": 6, "classifiers": ["FIRST_NAME", "LAST_NAME", "PERSON_NAME", "MALE_NAME", "FEMALE_NAME"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "PHI", "tag_value": "HIPAA Identifier: Date", "priority": 7, "classifiers": ["DATE_OF_BIRTH", "DATE"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "PHI", "tag_value": "HIPAA Identifier: Email Address", "priority": 8, "classifiers": ["EMAIL_ADDRESS"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "PHI", "tag_value": "HIPAA Identifier: Geographic Subdivision", "priority": 9, "classifiers": ["STREET_ADDRESS", "LOCATION", "LOCATION_COORDINATES", "US_STATE"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "PHI", "tag_value": "HIPAA Identifier: Device Identifier", "priority": 10, "classifiers": ["IMEI_HARDWARE_ID", "ICCID_NUMBER", "MAC_ADDRESS", "MAC_ADDRESS_LOCAL"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "PHI", "tag_value": "HIPAA Identifier: IP Address", "priority": 11, "classifiers": ["IP_ADDRESS"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "PHI", "tag_value": "HIPAA Identifier: URL", "priority": 12, "classifiers": ["URL"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "PHI", "tag_value": "HIPAA Identifier: License Number", "priority": 13, "classifiers": ["US_DRIVERS_LICENSE_NUMBER"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "PHI", "tag_value": "HIPAA Identifier: Vehicle Identification Number", "priority": 14, "classifiers": ["US_VEHICLE_IDENTIFICATION_NUMBER", "VEHICLE_IDENTIFICATION_NUMBER"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "PHI", "tag_value": "Diagnosis Code", "priority": 15, "classifiers": ["ICD9_CODE", "ICD10_CODE"] },
  { "tag_database": "<TAG_DATABASE>", "tag_schema": "<TAG_SCHEMA>", "tag_name": "PHI", "tag_value": "Medical Term", "priority": 16, "classifiers": ["MEDICAL_TERM"] }
]