Skip to content

You are viewing documentation for Immuta version 2023.3.

For the latest version, view our documentation for Immuta SaaS or the latest self-hosted version.

cancel

Purpose-Based Exceptions

Prerequisite: Before using this walkthrough, please ensure that you’ve done Parts 1-3 in the POV Data Setup walkthrough.

Overview

In the prior walkthroughs in this theme, we’ve spent a lot of time talking about attribute-based access controls and their benefits. However, in today’s world of modern privacy regulations, deciding what a single user can see is not just about who they are, but what they are doing. For example, the same user may not be able to see credit card information normally, if they are doing fraud detection work, they are allowed to.

This may sound silly because it’s the same person doing the analysis, why should we make this distinction? This gets into a larger discussion about controls. When most think about controls, we think about data controls - how do we hide enough information (hide rows, mask columns) to lower our risk. There’s a second control called contextual controls; what this amounts to is having a user agree they will only use data for a certain purpose, and not step beyond that purpose. Combining contextual controls with data controls is the most effective way to reduce your overall risk.

In addition to the data controls you’ve seen in Immuta, Immuta is also able to enforce contextual controls through what we term “purposes.” You are able to assign exceptions to policies, and those exceptions can be the purpose of the analysis in addition to who the user is (and what attributes they have). This is done through Immuta projects; projects contain data sources, have members, and are also protected by policy, but most importantly, projects can also have a purpose which can act as an exception to data policy. Projects can also be a self-service mechanism for users to access data for predetermined purposes without having to involve humans for ad hoc approvals.

Business Value

Purpose-based exceptions reduce risk and align with many privacy regulations, such as GDPR and CCPA. They also allow policy to be created a priori for exceptions to rules based on anticipated use cases (purposes) in your business, thus removing time-consuming and ad hoc manual approvals.

Because of this, the business reaps

  • Increased revenue: accelerate data access / time-to-data, no waiting for humans to make decisions.
  • Decreased cost: operating efficiently at scale, agility at scale because humans are removed from the daily approval flows.
  • Decreased risk: align to privacy regulations and significantly reduce risk with the addition of contextual controls.

Building a purpose exception

Assumptions: Your user has the following permission in Immuta (note you should have these by default if you were the initial user on the Immuta installation):

  • GOVERNANCE: in order to add a new purpose, build policy against any table in Immuta, and approve a purpose’s use in a user created project.

In this example we are going to hide credit card data unless acting under a certain purpose. Let’s start by creating the purpose as a user with GOVERNANCE permission.

  1. Click the Governance icon in the left sidebar of the Immuta console.
  2. On the Purposes tab, click + Add Purpose.
  3. For Purpose Name put Fraud Analysis.
  4. Leave the default Statement. However, this statement is important, it is what the user is agreeing to when they use this Purpose; you can edit this to whatever internal legal language you want.
  5. Leave the Description empty.
  6. Click Create.

You should see the Fraud Analysis purpose you created listed now. However, let’s add a hierarchy to this purpose, similar to what we did with tags in the Hierarchical Tag-Based Policy Definitions walkthrough.

  1. Click Edit to the right of your Fraud Analysis purpose to edit it.
  2. Click Add Sub Purpose.
  3. For the nested purpose, enter Charges.
  4. Click Save.

Now let’s build a policy:

  1. Click the Policies icon in the left sidebar.
  2. Click + Add New Data Policy.
  3. Name it Mask Credit Card Numbers.
  4. For action, select Mask.
  5. Leave columns tagged.
  6. Type in the tag Discovered.Entity.Credit Card Number.
  7. Change the masking type to by making null.
  8. Leave everyone except.
  9. Set when user is to acting under purpose.
  10. Set Fraud Analysis.Charges as the purpose.
  11. Click Add.

Now let’s add a second action to this policy:

  1. Click + Add Another Action.
  2. Select Limit usage to purpose(s).
  3. Select Fraud Analysis as the purpose. (Notice that we left off Charges, unlike above.)
  4. Change for everyone except to for everyone.
  5. Click Add.
  6. Leave Where should this policy be applied? as is.
  7. Click Create Policy and then Activate Policy.

Following the Query Your Data guide, confirm that neither your admin user nor the non-admin user you created in Part 3 of the POV Data Setup can see data in the “Fake Credit Card Transactions” table. This is because neither is acting under purpose Fraud Analysis. If they could query the table, they wouldn’t see the credit card numbers either, because they also aren’t acting under purpose Fraud Analysis.Charges.

Ok, so how do we work under a purpose? Let’s use your non-admin user you created in Part 3 of the POV Data Setup for this part to prove that this is completely self service for your users.

  1. Log in to Immuta with your non-admin user you created in Part 3 of the POV Data Setup in a private or incognito window.
  2. Click the Data icon and select Projects in the left sidebar of the Immuta console.
  3. Click + New Project.
  4. Name the Project My Fraud Project.
  5. Set the description as Immuta POV.
  6. Leave the documentation as the default. (You could add markdown to describe your project here.)
  7. Set your purpose to Fraud Analysis.
  8. Ignore Native Workspace.
  9. For Data Sources, select your Fake Credit Card Transactions table(s).
  10. Click Affirm and Create -- note that you are affirming the acknowledgement statement that popped up in the previous section.
  11. Click the Project Overview tab.
  12. You will see the Fraud Analysis purpose there, but it is staged.

At this point you have the project, but until another user with GOVERNANCE or PROJECT_MANAGEMENT permissions approves that purpose on that project, you cannot act under it. This is because a human must confirm that the data sources you added to the project align with the purpose you are acting under and the project you are attempting to accomplish. Yes, this is a manual approval step; however, it is fully documented in the project and audited, allowing the approver to make a decision with all information required. This is not a policy decision - it is a decision on if the project legitimately aligns to the purpose. Let’s go ahead and do that with your other user.

  1. Go to your Immuta window that has the admin user with GOVERNANCE permission logged in.
  2. You should see a little red dot above the Requests icon in the upper right corner of the Immuta console.
  3. If you click on the Requests icon, you will see you have There are 1 pending Purpose Approval request(s).
  4. Click the Review button. This will drop you into your Requests window under your profile. You can review the request by visiting the project through the hyperlink, but since you already know about the project, just click the checkbox on the right to approve it.
  5. Go back to the other non-admin user window and refresh the project screen.
  6. You will be asked to acknowledge the purpose per the statement that was attached when the purpose was created. Click I Agree. (That will be audited in Immuta.)
  7. Now that the Fraud Analysis purpose is active, click in the upper right corner of the console where it says No Current Project - that menu is how you switch your project contexts to act under a purpose.
  8. Set your current project to the one you created: My Fraud Project.

You are now acting under the purpose: Fraud Analysis.

To prove it, following the Query Your Data guide, confirm that non-admin user can see data in the “Fake Credit Card Transactions” table. Make sure you are querying as the non-admin user that just switched their project. Note that it may take 10 - 20 seconds or so before Immuta updates your current project in the enforcement point before you can see the data. (Immuta does some caching.)

Ok, that was cool, but look, the credit card numbers are null. This is because we use a more specific purpose to exception you from the credit card masking policy, remember, it was Fraud Analysis.Charges rather than just Fraud Analysis. So let’s make our purpose more specific in the Project, re-approve it, and then show the credit card numbers are in the clear.

  1. Using the non-admin user that created the project, click Manage above the purposes on the My Fraud Project Overview tab.
  2. In the Purposes drop down, uncheck Fraud Analysis and then select Fraud Analysis.Charges.
  3. This will require you to affirm the new purpose.
  4. Go back to your admin user and go through the flow of approving the purpose again; you will have another Requests notification. (You can just refresh the Requests screen if you are already there.)
  5. Once approved, go back to the non-admin user and refresh their My Fraud Project window.
  6. Click I Agree to the acknowledgement.

You are now acting under the purpose Fraud Analysis.Charges. Now query the data again with your non-admin user following the Query Your Data guide. The credit card numbers are in the clear because you are acting under the appropriate purpose!

But wait, did you notice something? Why are you able to see the table at all? You aren’t working under the purpose of Fraud Analysis anymore? This is because Fraud Analysis.Charges is a more specific subset of Fraud Analysis, so by acting under it you also are acting as any other Purposes further up the tree - the power of hierarchical purposes!

Clean up your instance

DO THIS: Ok, now we need to do some cleanup because we want to use that credit card data later in these walkthroughs and not have to act under a purpose to do so (this will let the other walkthroughs stand on their own without having to do this walkthrough).

  1. With your admin user, click the Policies icon in the left sidebar.
  2. Find the Mask Credit Card Numbers policy you created in this walkthrough.
  3. Click the menu button to the right of it and select Delete.
  4. Click Confirm.
  5. With your non-admin user, switch your project toggle: Switch Current Project: None. Note: If you do not do this step, you will only be able to see the tables in the My Fraud Project and no tables outside the My Fraud Project when querying data.

Anti-Patterns

Some may claim they can do purpose exceptions using - you guessed it - Roles! Sigh, as we’ve seen, this continues to exacerbate our role explosion problem.

Also, there are two kinds of RBAC models: flat and hierarchical. Flat means you can only work under one role at a time (Snowflake uses this model) which does align well if you wanted to do the anti-pattern and use roles. However, most databases (everything other than Snowflake) have hierarchical roles, meaning you act under all your roles at once. For hierarchical roles, using a role for purpose doesn’t work because at runtime you have no idea which purpose the user is actually acting under - why does that matter? Remember, the user acknowledged to only use the data for that certain purpose, if the user has no way to explicitly state which purpose they are acting under, how can we hold them accountable?

Lastly, there is no workflow for the user to acknowledge they will only use the data for the purpose if you are simply assigning them roles, nor is there a workflow to validate that the purpose is aligned to the project the user is working on.

For these reasons, Purpose needs to be its own object/concept in your access control model.

Next Steps

Feel free to return to the POV Guide to move on to your next topic.