column-mask-reapplication-on-cached-query-results

Column masks must be re-applied to cached query results at read time, not just at query execution time. If a role is revoked between the cache write and the cache read, the user would still receive unmasked data without re-application. This defense-in-depth ensures role revocation is effective immediately regardless of cache TTL.

Related

• column-masks-reapplied-post-cache-for-immediate-role-revocat
• column-masks-reapplied-on-cached-results-for-immediate-revoc
• cube-query-cache-column-masks-reapplied-on-cache-hit
• column-mask-reapply-on-cached-results
• column-masks-reapplied-on-cached-results-defense-in-depth
• column-masks-reapplied-post-cache-defense-in-depth