column-masks-reapplied-post-cache-for-immediate-role-revocat

column-masks-reapplied-post-cache-for-immediate-role-revocation

In R-Dash widget data pipeline, column masks are re-applied on cached Cube/SQL results even though the cache may have been populated under a different role context. This defense-in-depth ensures role revocation is effective immediately — a user whose role is revoked cannot receive unmasked data from a cached result populated when they had higher access. Cache stores raw results; masking is applied at serve time based on current role.

Related

• column-mask-reapply-on-cached-results
• column-masks-reapplied-on-cached-results-defense-in-depth
• column-masks-reapplied-on-cached-results-for-immediate-revoc
• cube-query-cache-column-masks-reapplied-on-cache-hit
• snowflake
• column-mask-reapplication-on-cached-query-results
• column-masks-reapplied-post-cache-defense-in-depth