rules.json

{
  "schemas": [
    {
      "group": "admin",
      "schema": "core_banking",
      "owner": true
    },
    {
      "group": "silver_access",
      "schema": "core_banking",
      "owner": false
    },
    {
      "group": "elivated_access",
      "schema": "core_banking",
      "owner": false
    },
    {
      "group": "admin",
      "schema": "segment",
      "owner": true
    },
    {
      "group": "silver_access",
      "schema": "segment",
      "owner": false
    },
    {
      "group": "elivated_access",
      "schema": "segment",
      "owner": false
    }
  ],
  "tables": [
    {
      "group": "admin",
      "schema": "core_banking",
      "privileges": ["SELECT", "INSERT", "DELETE", "UPDATE", "OWNERSHIP", "GRANT_SELECT"]
    },
    {
      "group": "admin",
      "schema": "segment",
      "privileges": ["SELECT", "INSERT", "DELETE", "UPDATE", "OWNERSHIP", "GRANT_SELECT"]
    },
    {
      "schema": "core_banking",
      "table": "accounts$snapshots",
      "privileges": ["SELECT"]
    },
    {
      "schema": "segment",
      "table": "segmentation",
      "privileges": ["SELECT"],
      "columns": [
        {
          "name": "party_key",
          "mask": "CASE WHEN contains(current_groups(), 'silver_access') THEN to_hex(sha256(cast(party_key AS varbinary))) ELSE cast(party_key AS varchar) END"
        }
      ]
    },
    {
      "schema": "core_banking",
      "table": "accounts",
      "privileges": ["SELECT"],
      "filter": "CASE WHEN contains(current_groups(), 'silver_access') THEN to_hex(sha256(cast(party_key AS varbinary))) ELSE cast(party_key AS varchar) END IN (SELECT party_key FROM segment.segmentation WHERE contains(current_groups(), market))",
      "columns": [
        {
          "name": "party_key",
          "mask": "CASE WHEN contains(current_groups(), 'silver_access') THEN to_hex(sha256(cast(party_key AS varbinary))) ELSE cast(party_key AS varchar) END"
        },
        {
          "name": "account_number",
          "mask": "CASE WHEN contains(current_groups(), 'silver_access') THEN to_hex(sha256(cast(account_number AS varbinary))) ELSE cast(account_number AS varchar) END"
        },
        {
          "name": "account_holder_name",
          "mask": "CASE WHEN contains(current_groups(), 'silver_access') THEN to_hex(sha256(cast(account_holder_name AS varbinary))) ELSE cast(account_holder_name AS varchar) END"
        },
        {
          "name": "balance",
          "allow": true
        },
        {
          "name": "account_type",
          "allow": true
        }
      ]
    },
    {
      "schema": "core_banking",
      "table": "transactions",
      "privileges": ["SELECT"],
      "columns": [
        {
          "name": "transaction_id",
          "allow": true
        },
        {
          "name": "party_key",
          "mask": "CASE WHEN contains(current_groups(), 'silver_access') THEN to_hex(sha256(cast(party_key AS varbinary))) ELSE cast(party_key AS varchar) END"

        },
        {
          "name": "transaction_date",
          "allow": true
        },
        {
          "name": "amount",
          "allow": true
        },
        {
          "name": "transaction_type",
          "allow": true
        }
      ]
    },
    {
      "schema": "core_banking",
      "table": "payments",
      "privileges": ["SELECT"],
      "columns": [
        {
          "name": "payment_id",
          "allow": true
        },
        {
          "name": "payer_party_key",
          "mask": "CASE WHEN contains(current_groups(), 'silver_access') THEN to_hex(sha256(cast(payer_party_key AS varbinary))) ELSE cast(payer_party_key AS varchar) END"
        },
        {
          "name": "payee_party_key",
          "mask": "CASE WHEN contains(current_groups(), 'silver_access') THEN to_hex(sha256(cast(payee_party_key AS varbinary))) ELSE cast(payee_party_key AS varchar) END"
        },
        {
          "name": "payment_date",
          "allow": true
        },
        {
          "name": "amount",
          "allow": true
        },
        {
          "name": "payment_method",
          "allow": true
        }
      ]
    }
  ]
}