column-masks-reapplied-on-cached-results-defense-in-depth

Column masks are re-applied on cached QueryResults even after Cube returns data. This is a defense-in-depth pattern so that role revocation is effective immediately on cached rows — the cache does not bypass mask enforcement.

Related

• cube-query-uses-5min-hs256-jwt-with-security-context
• rbac-rls-at-query-execution-layer-is-non-negotiable-enterpri
• vantage-rbac-rls-non-negotiable-v1-gate
• rbac-rls-must-enforce-at-query-execution-not-ui
• rls-at-query-execution-layer-enterprise-bi-non-negotiable
• column-mask-reapply-on-cached-results
• cube-query-cache-column-masks-reapplied-on-cache-hit
• column-masks-reapplied-on-cached-results-for-immediate-revoc
• column-masks-reapplied-post-cache-for-immediate-role-revocat
• column-mask-reapplication-on-cached-query-results
• column-masks-reapplied-post-cache-defense-in-depth