Tag

#data-masking

2 posts ·all posts

Relatedrangersecurityicebergsparksnowflake
· Jacob Verhoeks

One mask, and Spark and SQE agree to the byte

SQE's fine-grained Ranger backend does row filters, column masks, role-conditional masking, and tags. The kicker: the same Ranger policy on the same Polaris catalog produces byte-exact identical masked output in SQE and in standard Apache Spark. We proved it live, and the first run failed for a reason no amount of reading could have predicted.

Read
· Jacob Verhoeks

Snowflake's governance model on open Iceberg

Snowflake gives you masking policies, row access policies, object tags, and a GRANT model. SQE gives you the same primitives on Apache Ranger and open Iceberg, enforced by plan rewrite and shared across engines. Here is the mapping, the one real edge SQE has, and the gaps we have not closed yet.

Read