Skip to content

Policies

This is where Attributes, Countries, and Claims come together into an actual governance rule.

A Policy controls who is allowed to see a piece of sensitive data unprotected, and under what circumstances.

Every Policy answers three questions:

  1. What is being protected? One or more Attributes (like Email or Salary) or Attribute Groups (a bundle of related Attributes, like "Financial Data").
  2. Who is allowed to see it unprotected? Defined by Country and Claims, for example "users in Germany" or "users matching the Compliance Claim Pack."
  3. Why are they allowed to see it? The Purpose of Use they've declared, for example "Customer Support" or "Regulatory Reporting," configured under Data Usage.

If a request doesn't match all three, eXate falls back to the Attribute's default protection (mask, tokenize, encrypt, or redact) instead of returning the raw value.

Example

A Policy scoped to the PII Attribute Group might allow it unprotected only for users in the UK, with the Claim Department = Compliance, and Purpose of Use Audit. Anyone else querying that same data, anywhere in the system, sees it protected by the Attribute's default PET instead.

This is what makes Policies powerful: you define the rule once against the data's classification, and it's enforced consistently everywhere that Attribute appears, across APIgator, Datagator, and GatorSet, without touching application code.

Where to manage Policies

Sign into the eXate portal, go to Central Services on the left menu, then Policies. From here you can view, edit, or delete any existing Policy, or create a new one, see Creating a Policy.

Formerly Rules / Rule Packs

Policies were previously called Rules (grouped into Rule Packs). If you see "Rule" or "Rule Pack" referenced in older material or UI screenshots, it refers to this same feature.

Tagging a Policy's Driver

A Policy can be tagged with the regulation or internal policy that requires it, GDPR, DORA, or others, using Meta Tags. This is a planned rather than fully built-out use case currently, see that page for the details.

What's next

A Policy is a governance rule, but it doesn't protect anything on its own yet, it needs to be attached to real data. That's what Manifests do: they map your actual JSON paths, files, or database columns to Attributes, which is what activates column-level protection.