cube-query-cache-column-masks-reapplied-on-cache-hit

Column masks are deliberately re-applied to cached Cube query results on every cache hit, not only on cache miss. This makes role revocation effective immediately without requiring cache invalidation. Removing the re-apply step on cache hits would create a window where revoked roles still see unmasked data.

Related

• column-masks-reapplied-on-cached-results-defense-in-depth
• column-mask-reapply-on-cached-results
• cube-query-uses-5min-hs256-jwt-with-security-context
• r-same-m1-identity-pass-2-admin-mfa-enroll-password-reset-re
• r-same-m2-data-sources-m3-query-engine-foundation
• column-masks-reapplied-on-cached-results-for-immediate-revoc
• column-masks-reapplied-post-cache-for-immediate-role-revocat
• column-mask-reapplication-on-cached-query-results