Masking Enforcement and Identity Mapping in a Health Insurer
A health insurer uses CP4D 4.7 with WKC, Watson Studio, and DataStage. Four hundred analysts authenticate through SAML to an external IdP; authorization uses LDAP groups mapped to CP4D roles. A new privacy rule says only the Claims Privacy group may see member ID and diagnosis columns; all other users must see masked values in catalog previews and SQL queries. During an audit, a DataStage developer exported a catalog asset to CSV and the file contained unmasked member IDs. Analysts in the Data Viewer role report they can open a catalog but cannot preview any asset, while a steward in the same group can. The IdP changed the NameID format last week. Audit logs show service accounts, not human user IDs, for several WKC actions. The CISO wants evidence that masking is enforced consistently and that access reviews are possible. Diagnose the symptoms and propose a governance and identity design.
1. Why did the DataStage export contain unmasked values, and how should masking be enforced consistently?
Read the worked answer
The export bypassed governance because WKC masking is enforced when a governed query engine reads the asset, not when a developer uses a raw connection credential. DataStage likely connected with a service account that has direct table privileges, so the CSV contained source values. Preview masking in the catalog is not proof of enforcement.
Fix this in layers: restrict raw credentials to a small set of service accounts; grant analysts access only through governed virtual views or masked columns; define data protection rules on classified columns and test them as a non-privileged user; add a database-level dynamic mask or column mask where the source supports it; and make DataStage write to a curated, masked target rather than export raw member IDs. Add a pre-export policy check and audit DataStage job credentials. The CISO evidence should include rule definitions, test results with a non-privileged account, and logs showing the service account used.
2. Diagnose why viewers cannot preview assets while stewards can, and explain the impact of the NameID change.
Read the worked answer
A viewer role, whether platform or catalog, does not by itself grant access to asset data. A user can open a catalog but see no preview if the asset is in a catalog where they lack the required collaborator role, if the asset is not published, or if the connection requires separate credentials. The steward works because stewardship or asset-level permissions add data access. Check catalog collaborator roles and asset membership before changing platform roles.
The NameID change is a separate identity fault: if the IdP now sends a different NameID format, CP4D may fail to map the assertion to the existing user or may create a new identity, breaking group membership and audit attribution. Update the SAML mapping, confirm the expected NameID and group attribute, and have affected users re-authenticate. Check IAM for duplicate users. Do not fix this by assigning roles directly to users.
3. Design access reviews and audit evidence that would satisfy the CISO.
Read the worked answer
Design access reviews around IdP groups, not individual assignments. Map each LDAP or SAML group to a CP4D group with a documented role, and make catalog access flow from group membership. Use WKC workflows for catalog and asset approvals, and record data protection rules as governed artifacts. For audit, export platform, IAM, and WKC audit events to the SIEM, and ensure the human user ID is carried through; service accounts should be named, owned, rotated, and excluded from user access reviews.
Run quarterly certifications: list group-to-role mappings, catalog collaborators, and users with data access, and have owners attest. Test masking with a non-privileged account each quarter and keep the results. The finding that logs show service accounts means you need to correlate job IDs and connection IDs to the owning human or application. Without that correlation, you cannot prove who accessed masked data.