Recognises a restricted column without access design
https://knobit.org/id/knobit/K-821
Also as Turtle · JSON-LD · RDF/XML · AI benchmark on Skilirium
| Context functions | Result evaluation |
|---|---|
| Knobit creation methods | AI generated, AI edited |
| Knobit creation methods | AI generated, human edited |
| Knobit types | Skill |
| LCG purposes | Assessing the learner's knowledge or skill state |
| LCG purposes | Selecting an assessment task or learning activity |
| action verb | Recognises en |
| applies knowledge | Explains access design for classified data |
| applies knowledge | Explains least-privilege access design |
| assessment criterion | Flags the deficient case and passes the acceptable one. Deficient: `dim_party.birth_date` and a card number column, both `restricted`, created in `rpdm` with no masked view, no role and nothing in the handover; a full PAN sitting in an analytics schema forty analysts can query Acceptable: The restricted columns listed in the handover with the access design each needs — a masked view, a separate role, the PAN truncated to the last four digits or left in the card system — written and reviewed as its own script. The classifications drive that conversation; they do not generate it en |
| assessment criterion | Flags the deficient case and passes the acceptable one. Deficient: `hardship_case.reason_text` restricted, no access design Acceptable: Named role, masked elsewhere en |
| assessment method | Review of the stage 3 eval project (reffa/skills, data-security/evals) en |
| assessment method | skill-tests task: Generated DDL review, Postgres and Snowflake (DDL review skills) en |
| conforms to profile | https://oppekava.edu.ee/a/Knobitite_kirjeldamise_ja_seostamise_reeglid#LCG-KNOBIT-0.1 |
| dcterms:identifier | K-821 |
| dcterms:identifier | S-312 |
| dcterms:license | https://creativecommons.org/licenses/by/4.0/ |
| dcterms:source | Review checklist 03-access-control, row 12 (27002 8.3; DMBOK) en |
| dcterms:source | Review checklist 05-ddl, row 21; PCI DSS v4.0; this skill (08-ddl.md) en |
| expected result | The column and the access design it needs en |
| expected result | The column and the grants, masking or row security it needs en |
| owl:sameAs | https://bitbucket.org/reffa/ontology/id/knobit/data-modelling/08-ddl/21 |
| rdfs:label | Recognises a restricted column without access design en |
| schema:creativeWorkStatus | accepted |
| schema:isPartOf | Data modelling (DAMA-DMBOK2) |
| schema:isPartOf | Data security and privacy (DAMA-DMBOK2) |
| skos:altLabel | Restricted column with no access design en |
| skos:altLabel | Restricted column with no access design (generated DDL) en |
| skos:definition | A column classified `restricted` or `confidential` in the model, created by a plain `CREATE TABLE`. The generator deliberately emits no `GRANT`, role, masking policy or row-level security, so the finding is never "the SQL is missing them" — it is that nothing else covers them and the table is about to exist where everyone can read it. en |
| skos:definition | A restricted column no role, masking or row policy addresses. en |
| skos:prefLabel | Recognises a restricted column without access design en |
| target object | classified column en |
| target object | restricted column no role, mask or row policy addresses en |
Used by
| includes knobit | Generates DDL per target dialect and reviews it against model, engine, data and deployment |
|---|---|
| includes knobit | Designs access by need, with duties segregated and masking that holds |
| requires knobit | Generate and review DDL |
| requires knobit | Design access control |