Policies and certification

Access policies

Access policies decide what a person or an API key may see when a semantic query runs. They are compiled into the generated SQL by the query compiler, so the same rule applies to serving endpoints, the Playground, SQL preview, MCP tool calls and the assistant.

Types

Type	Effect
ColumnMask	Full (****), Partial (**** + the last 1–8 characters; fully masked when the value is that short), Hash (lower-case SHA-256 hex) or Null. Masked time dimensions become a typed NULL.
RowFilter	A predicate injected at the base table, with templates {{user.attributes.region}}, {{user.id}}, {{user.roles}}.
Deny	The asset is hidden. A hidden asset is indistinguishable from an unknown name (422 with no suggestions).

Scope: an asset (entity, dimension, table or column for masks; entity or table for row filters), a tag, a domain (including sub-domains) or a sensitivity level and above. Targets: workspace roles in Applies to (empty = everyone) and Exempt.

Combining and failing closed

• The strictest mask wins (Null > Full > Hash > Partial; fewer visible characters is stricter); row filters are ANDed; Deny wins. Only accepted, enabled policies are enforced.
• A row filter whose template can't be satisfied — a missing attribute, a missing dimension, a wrongly typed value, an unknown operator — compiles to 1 = 0: no rows.
• Hash digests differ between dialects (UTF-8 on PostgreSQL, UTF-16 on SQL Server).

Who is the principal?

People are evaluated with their workspace role and their attributes (set by Owners/Admins through the API, or mapped from IdP claims listed in Keel:AccessPolicies:AttributeClaims; Admin-set values win). API keys are evaluated as Analysts with no attributes. viewAs on a query body is for users who can govern.

Defaults and the simulator

Keel proposes a default policy, mask_restricted_for_analysts (Restricted and above, full mask, for Analysts and Viewers), on every release and on demand; Apply default mask on the Metrics page accepts and enables it in one step. The simulator on the Policies page shows, for a member or a role, which policies apply and why, the effective filters and masks, and preview rows.

Known gaps

Exports do not carry access policies yet (the exporters can map them, but no policy summary reaches them). There is no Admin screen for member attributes — they are set through the API.

Certification

Metrics move through Draft → Reviewed → Certified → Deprecated. Certification is authoritative in Governance and read everywhere a metric is shown: catalogs, exports, MCP and the assistant.

Default criterion (tenant-configurable)	Checked how
An owner	Ownership assignment, or inherited from the entity or model
At least one Approved glossary term	Glossary links or the metric's own term ids
A description of 20+ characters	The released document
DQ gate passed	Rules cover the upstream tables and pass (no covering rules = unmet)
Trust ≥ 80	The current trust score
Steward approval	The Certify action by someone who can govern

• Request certification moves a Draft to Reviewed and notifies stewards; if criteria are unmet, the request answers 422 Governance.CertificationCriteriaNotMet with the list.
• Certification is valid for 180 days by default (30–730). A daily job warns 14 days ahead and returns lapsed metrics to Reviewed.
• A Certified metric whose trust is capped by a failing Critical rule is flagged At risk.
• Criteria and validity are tenant settings (Owners): PUT …/certification/settings.