Filter Expressions

Policies and PETs control access and protection at the column/field level, but neither decides which rows a requester should see at all. Filter Expressions are what add that row-level layer on top, this is how eXate implements row-level security (RLS).

Filter Expression Action is reference metadata describing the types of actions eXate's Filters can perform, for example redact, mask, tokenize, or encrypt a value when a Filter's conditions are met. This metadata is published as part of entitlements for downstream systems to consume, so a system reading an entitlement can understand not just that a value was protected, but how.

This is distinct from a Policy: a Policy decides who can see an Attribute unprotected. A Filter, using the Actions defined here, decides what happens to the value itself, redaction, masking, or transformation, when a request doesn't qualify for unprotected access, or when a more specific condition applies, and can be scoped to specific rows via its query filter, rather than applying uniformly across an entire dataset.

Access it via Central Services → Data Management → Filter Expression Action.

What's next

With the full protection model in place, Attributes through Filter Expressions, the remaining sections cover the infrastructure and administration underneath it: Vault for configuration and connections, and Admin for managing the tenancy itself.