Data governance: tags, policies and masking
How Data 360 turns governance requirements into configuration: tags and AI tag suggestions, tag propagation, allow and deny access policies at object, field and record level, Dynamic Data Masking methods, the ABAC setup steps (ending with deleting Allow All), and Platform Encryption key options.
Apply data governance requirements to platform configuration.
~8 min read · 10 practice questions ·
What the exam expects
- Complete an attribute-based access control (ABAC) setup in order, including custom permissions and deleting the Allow All policy.
- Choose between an object-level, field-level or record-level access policy and a Dynamic Data Masking policy, and pick the masking method.
- Predict policy outcomes: deny over allow, query behavior, timing, and where record-level policies don't apply.
- Explain manual tagging, AI tag suggestions, tag propagation and which features need the Dynamic Data Masking add-on.
- Choose a Platform Encryption key option and explain root key states and sandbox behavior.
Key terms: tag is a label on an object or field that policies evaluate; classification groups tags by sensitivity, such as public or restricted; ABAC applies policies through data attributes (tags) and user attributes (custom permissions); Allow All policy (day zero policy) is the default policy granting access to all objects in a user's data spaces; dynamic masking changes values at query time without changing stored data.
Key facts
- Detail
- Allow All (day zero) grants all objects in assigned data spaces
- Detail
- 2 to 3 minutes to take effect after create or modify
- Detail
- Deny beats allow; View All or Modify All Records users bypass deny
- Detail
- Only in custom permission sets, not standard sets or clones
- Detail
- Only Deny access is supported
- Detail
- Up to 5 conditions, 3 joins; not enforced in segments or calculated insights
- Detail
- Reads metadata only; steward or admin approves
- Detail
- AI-assisted tagging and dynamic masking need Dynamic Data Masking
- Detail
- Not inherited from production; enable Manage Data 360 Keys per sandbox
- Detail
- Still decrypts existing data; doesn't encrypt new data
Sources for this section (10)
- Assign Data Accesshelp.salesforce.com (opens in a new tab)
- Policy-Based Governance in Data 360help.salesforce.com (opens in a new tab)
- Data Governance Considerationshelp.salesforce.com (opens in a new tab)
- Impact of Custom Permissions on Policieshelp.salesforce.com (opens in a new tab)
- Create an Object or Field-Level Access Policy in Data 360help.salesforce.com (opens in a new tab)
- Create a Record-Level Policy in Data 360help.salesforce.com (opens in a new tab)
- Manual and Automatic Tagging in Data 360help.salesforce.com (opens in a new tab)
- Data Cloud Governance Feature Availability by Licensehelp.salesforce.com (opens in a new tab)
- Platform Encryption for Data 360help.salesforce.com (opens in a new tab)
- Root Key Lifecyclehelp.salesforce.com (opens in a new tab)
- Why can a marketer still segment on records a record-level policy hides from her in Data Explorer?
- When does a new or changed policy take effect?
- Which masking method keeps a birth date useful for age bands?
- Why must Platform Encryption be enabled separately in a sandbox?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Data 360 Consultant pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 22 lessons of the Data 360 Consultant guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (10 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams