Skip to main content

PrivaceraCloud Documentation

Create scheme policies

:

You can create scheme policies to restrict data users or groups in their use of specific encryption or presentation schemes.

Create scheme policies on PrivaceraCloud

Prerequisites:

  • Decide which users, groups, or roles you want to apply the scheme policy to.

  • Decide how you want to give permissions to those users, groups, or role. You can either allow them or deny them the use of encryption or presentation schemes.

To create scheme policies on PrivaceraCloud, follow these steps:

  1. Go Access Management > Scheme Policies.

  2. Find and click the PEG resource name.

  3. If you want this scheme policy to be in effect for only a specific time period, in the upper right, click Add Validity Period and enter the details of that period.

  4. Enter a name for the scheme policy.

  5. If desired, select any policy labels you want for this scheme policy.

  6. If you do not want audit logging, use the Audit Logging toggle to turn it off.

  7. With the Enabled toggle, you can create the policy but not yet enable it.

  8. In the Encryption scheme dropdown, you can select either the Encryption scheme or the Masking scheme.

    • If you select Encryption Scheme, enter the name of the encryption scheme to which you want to apply the policy. Repeat this for all required encryption schemes.

      When you select the Encryption scheme, the Presentation Scheme appears automatically.

    • If you select Masking Scheme, enter the name of the masking scheme to which you want to apply the policy. Repeat this for all required masking schemes.

      When you select Masking Scheme, the mask permission appears in the Permissions section.

  9. For Presentation Schemes field, select the name of the presentation scheme to which you want to apply the policy. Repeat this for all required presentation schemes.

  10. Enter a description of this scheme policy.

  11. Depending on how you have decided to allow or deny access, use the fields in Allow conditions or Deny Conditions and follow the corresponding steps below:

    • Allow Access

      1. Under Allow Conditions, in the role, group, and user fields, select the names of roles, groups, or users you want to give access to the schemes.

      2. On the right, click Add Permission and specify the permission you want to give.

        • getSchemes permission is required for Databricks UDFs.

        • protect/unprotect permissions are required for REST API calls.

      3. On the far right, click Delegate Admin if you want the service user to be able to make API requests on behalf of the application user.

      4. If you want to deny access to specific roles, groups, or users, under Exclude from Allow Conditions, select those roles, groups, or users you want to exclude.

    • Deny Access

      1. Under Deny Conditions, in the role, group, and user fields, select the names of roles, groups, or users you want to deny access to the schemes.

      2. On the right, click Add Permission and specify the permission you want to deny.

      3. On the far right, click Delegate Admin if you want the service user to be able to make API requests on behalf of the application user.

      4. If you want to give access to specific roles, groups, or users, under Exclude from Deny Conditions, select those roles, groups, or users you want to allow.

  12. Save your scheme policy.