# Data governance: tags, policies and masking

*Data 360 Consultant Study Guide · Data 360 Setup and Administration · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/data-360-consultant/data-360-setup-and-administration/data-governance-tags-policies-and-masking*

How Data 360 turns governance requirements into configuration: tags and AI tag suggestions, tag propagation, allow and deny access policies at object, field and record level, Dynamic Data Masking methods, the ABAC setup steps (ending with deleting Allow All), and Platform Encryption key options.

- Certification: Salesforce Data 360 Consultant
- Exam section: Data 360 Setup and Administration
- Study guide: https://www.certifyforce.com/study-guide/data-360-consultant

**Official exam objective:**

> Apply data governance requirements to platform configuration.

## What the exam expects

- Complete an attribute-based access control (ABAC) setup in order, including custom permissions and deleting the Allow All policy.
- Choose between an object-level, field-level or record-level access policy and a Dynamic Data Masking policy, and pick the masking method.
- Predict policy outcomes: deny over allow, query behavior, timing, and where record-level policies don't apply.
- Explain manual tagging, AI tag suggestions, tag propagation and which features need the Dynamic Data Masking add-on.
- Choose a Platform Encryption key option and explain root key states and sandbox behavior.

Key terms: **tag** is a label on an object or field that policies evaluate; **classification** groups tags by sensitivity, such as public or restricted; **ABAC** applies policies through data attributes (tags) and user attributes (custom permissions); **Allow All policy** (day zero policy) is the default policy granting access to all objects in a user's data spaces; **dynamic masking** changes values at query time without changing stored data.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Default policy | Allow All (day zero) grants all objects in assigned data spaces | [Assign Data Access](https://help.salesforce.com/s/articleView?id=data.c360_a_dc_access.htm&language=en_US&type=5) |
| Policy timing | 2 to 3 minutes to take effect after create or modify | [Policy-Based Governance in Data 360](https://help.salesforce.com/s/articleView?language=en_US&id=data.c360_a_policy_based_governance_dg.htm&type=5) |
| Conflicts | Deny beats allow; View All or Modify All Records users bypass deny | [Data Governance Considerations](https://help.salesforce.com/s/articleView?id=data.c360_a_before_you_begin_data_gov.htm&language=en_US&type=5) |
| Custom permissions | Only in custom permission sets, not standard sets or clones | [Impact of Custom Permissions on Policies](https://help.salesforce.com/s/articleView?id=data.c360_a_using_custom_permissions.htm&language=en_US&type=5) |
| Field-level action | Only Deny access is supported | [Create an Object or Field-Level Access Policy in Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_create_ols_fls_policy.htm&language=en_US&type=5) |
| Record-level limits | Up to 5 conditions, 3 joins; not enforced in segments or calculated insights | [Create a Record-Level Policy in Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_create_rls_policy.htm&language=en_US&type=5) |
| Suggest Tags | Reads metadata only; steward or admin approves | [Manual and Automatic Tagging in Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_manual_automatic_tagging.htm&language=en_US&type=5) |
| Add-on features | AI-assisted tagging and dynamic masking need Dynamic Data Masking | [Data Cloud Governance Feature Availability by License](https://help.salesforce.com/s/articleView?id=data.c360_a_data_gov_feature_availability.htm&language=en_US&type=5) |
| Sandbox encryption | Not inherited from production; enable Manage Data 360 Keys per sandbox | [Platform Encryption for Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_platform_encryption_for_data_cloud.htm&language=en_US&type=5) |
| Archived root key | Still decrypts existing data; doesn't encrypt new data | [Root Key Lifecycle](https://help.salesforce.com/s/articleView?id=data.c360_a_root_key_lifecycle.htm&language=en_US&type=5) |

## Check yourself

- Why can a marketer still segment on records a record-level policy hides from her in Data Explorer?
- When does a new or changed policy take effect?
- Which masking method keeps a birth date useful for age bands?
- Why must Platform Encryption be enabled separately in a sandbox?

## Sources

- [Data Governance in Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_data_gov_capabilities.htm&language=en_US&type=5)
- [Get Started with Data Governance](https://help.salesforce.com/s/articleView?id=data.c360_a_getting_started_data_gov.htm&language=en_US&type=5)
- [Assign Data Access](https://help.salesforce.com/s/articleView?id=data.c360_a_dc_access.htm&language=en_US&type=5)
- [Policy-Based Governance in Data 360](https://help.salesforce.com/s/articleView?language=en_US&id=data.c360_a_policy_based_governance_dg.htm&type=5)
- [Data Governance Considerations](https://help.salesforce.com/s/articleView?id=data.c360_a_before_you_begin_data_gov.htm&language=en_US&type=5)
- [Impact of Custom Permissions on Policies](https://help.salesforce.com/s/articleView?id=data.c360_a_using_custom_permissions.htm&language=en_US&type=5)
- [Create an Object or Field-Level Access Policy in Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_create_ols_fls_policy.htm&language=en_US&type=5)
- [Policy Behavior When Querying Data](https://help.salesforce.com/s/articleView?id=data.c360_a_policy_behavior_when_querying_data_in_datacloud.htm&language=en_US&type=5)
- [Create a Record-Level Policy in Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_create_rls_policy.htm&language=en_US&type=5)
- [Create a Dynamic Data Masking Policy for Structured Data](https://help.salesforce.com/s/articleView?id=data.c360_a_dynamic_data_masking_policy.htm&language=en_US&type=5)
- [Manual and Automatic Tagging in Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_manual_automatic_tagging.htm&language=en_US&type=5)
- [Tag Propagation in Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_tag_propagation.htm&language=en_US&type=5)
- [Data Cloud Governance Feature Availability by License](https://help.salesforce.com/s/articleView?id=data.c360_a_data_gov_feature_availability.htm&language=en_US&type=5)
- [Platform Encryption for Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_platform_encryption_for_data_cloud.htm&language=en_US&type=5)
- [About Data Spaces](https://help.salesforce.com/s/articleView?id=data.c360_a_data_spaces.htm&language=en_US&type=5)
- [Root Key Lifecycle](https://help.salesforce.com/s/articleView?id=data.c360_a_root_key_lifecycle.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 10 linked practice questions, and unlimited timed mock exams are included with the Data 360 Consultant pack (USD $19): https://www.certifyforce.com/practice-exams