@prefix dcterms: <http://purl.org/dc/terms/> .
@prefix edu: <https://knobit.org/def/> .
@prefix knobit: <https://knobit.org/id/knobit/> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix register: <https://knobit.org/id/register/> .
@prefix schema: <https://schema.org/> .
@prefix skos: <http://www.w3.org/2004/02/skos/core#> .

knobit:K-821 a edu:Knobit ;
    rdfs:label "Recognises a restricted column without access design"@en ;
    dcterms:identifier "K-821",
        "S-312" ;
    dcterms:license <https://creativecommons.org/licenses/by/4.0/> ;
    dcterms:source "Review checklist 03-access-control, row 12 (27002 8.3; DMBOK)"@en,
        "Review checklist 05-ddl, row 21; PCI DSS v4.0; this skill (08-ddl.md)"@en ;
    skos:altLabel "Restricted column with no access design"@en,
        "Restricted column with no access design (generated DDL)"@en ;
    skos:definition "A column classified `restricted` or `confidential` in the model, created by a plain `CREATE TABLE`. The generator deliberately emits no `GRANT`, role, masking policy or row-level security, so the finding is never \"the SQL is missing them\" — it is that nothing else covers them and the table is about to exist where everyone can read it."@en,
        "A restricted column no role, masking or row policy addresses."@en ;
    skos:prefLabel "Recognises a restricted column without access design"@en ;
    edu:actionVerb "Recognises"@en ;
    edu:appliesKnowledge knobit:K-856,
        knobit:S-351 ;
    edu:assessmentCriterion "Flags the deficient case and passes the acceptable one. Deficient: `dim_party.birth_date` and a card number column, both `restricted`, created in `rpdm` with no masked view, no role and nothing in the handover; a full PAN sitting in an analytics schema forty analysts can query Acceptable: The restricted columns listed in the handover with the access design each needs — a masked view, a separate role, the PAN truncated to the last four digits or left in the card system — written and reviewed as its own script. The classifications drive that conversation; they do not generate it"@en,
        "Flags the deficient case and passes the acceptable one. Deficient: `hardship_case.reason_text` restricted, no access design Acceptable: Named role, masked elsewhere"@en ;
    edu:assessmentMethod "Review of the stage 3 eval project (reffa/skills, data-security/evals)"@en,
        "skill-tests task: Generated DDL review, Postgres and Snowflake (DDL review skills)"@en ;
    edu:contextFunction <https://knobit.org/def/contextFunction/resultEvaluation> ;
    edu:creationMethod <https://knobit.org/def/creationMethod/aiGeneratedAiEdited>,
        <https://knobit.org/def/creationMethod/aiGeneratedHumanEdited> ;
    edu:expectedResult "The column and the access design it needs"@en,
        "The column and the grants, masking or row security it needs"@en ;
    edu:graphRelevance <https://knobit.org/def/graphRelevance/learnerState>,
        <https://knobit.org/def/graphRelevance/taskSelection> ;
    edu:knobitType <https://knobit.org/def/knobitType/skill> ;
    edu:targetObject "classified column"@en,
        "restricted column no role, mask or row policy addresses"@en ;
    schema:creativeWorkStatus "accepted" ;
    schema:isPartOf register:data-modelling,
        register:data-security .

edu:Knobit rdfs:label "Knobit"@en,
        "Knobit"@et .

knobit:K-856 rdfs:label "Explains access design for classified data"@en .

knobit:S-351 rdfs:label "Explains least-privilege access design"@en .