Comparison
Column-level securityvsData classification
Column-level security
everyone can query the customer table and only three people can select the date-of-birth column.
Access control applied per column rather than per table. It is what makes broad access to a wide table safe, and it pairs naturally with classification tags so the policy is written once against the tag. Its practical limitation is that derived tables do not inherit it — a model selecting a protected column into a new table has quietly laundered the control unless the platform propagates tags.
Full entry →Data classification
every column is tagged as public, internal or restricted, and the access rules are generated from the tags rather than written per table.
Labelling data by sensitivity so that policies can be applied by label rather than table by table. It is what makes governance scale past a few dozen tables, because a rule expressed over a tag automatically covers next month's new table. Its weak point is coverage: an untagged column defaults to whatever the platform's default is, so the default has to be the restrictive one.
Full entry →