Skip to main content
When you ingest data, you can either select or create a tag. A tag grants a role an access level on every table and column that carries it, including ones tagged later. For example, you can give the nx1_engineer role the Read level on a tag, so engineers can read every table that carries that tag.

Prerequisites

Before starting this task, ensure you have the following:
  • Required roles: nx1_migration_admin or nx1_migration_ops.
  • A Ranger tag service linked to NexusOne. Without it, the Tag option doesn’t appear.

Grant a role access to a tag

Perform these steps to grant a role access to a tag.
  1. Log in to NexusOne.
  2. On the top navigation bar, hover your mouse over Govern and then select Data Access.
  3. Click the Grant access tab.
  4. Under Who, in the Groups field, select the role to give access to. Roles appear as groups.
  5. Optional: In the Users field, select the users to give access to.
  6. Under On what, click Tag.
  7. In the Tag field, select the tag.
  8. Under Access level, select the level to grant. For what each level includes, refer to Access levels.
  9. Optional: Under Conditions, in the Hide the values of tagged columns field, select one of the following:
    • Custom: Applies a custom masking expression from Ranger.
    • Don’t hide: Shows the values.
    • Hash: Replaces the value with its hash.
    • Nullify: Replaces the value with null.
    • Partial mask: show first 4: Hides all but the first four characters.
    • Partial mask: show last 4: Hides all but the last four characters.
    • Redact: Replaces the value with a placeholder character.
    • Unmasked: Keeps the original value.
  10. Optional: In the Why field, enter who asked for the access and what it is for.
  11. Click Preview to see the policies the grant writes and whose access changes.
  12. Click Apply.

Additional resources

  • For an overview of the Govern feature, refer to Govern Overview.
  • You can also grant this access directly in Ranger. For the steps, refer to Create a policy.