The Sovereign Database Modeling Studio for Engineering Teams

-- Postgres Role-Based Secure Masking
CREATE TABLE "tbl_customer" (
    "id" VARCHAR(36) PRIMARY KEY,
    "email" VARCHAR(512) UNIQUE NOT NULL
);

-- Generated Access Control View
CREATE SECURE VIEW secure_customer_view AS 
SELECT id, 
       CASE WHEN pg_has_role(current_user, 'billing_sec') 
            THEN email ELSE '********' END AS email
FROM tbl_customer;

-- Snowflake Dynamic Masking Policies
CREATE OR REPLACE MASKING POLICY email_mask AS (val string) 
  RETURNS string -> 
  CASE WHEN CURRENT_ROLE() IN ('SECURITY_ADMIN') 
       THEN val ELSE '*********' END;

ALTER TABLE tbl_customer MODIFY COLUMN email 
  SET MASKING POLICY email_mask;

model Customer {
  id    String @id @default(uuid())
  email String @unique // @pii-encrypted

  @@map("tbl_customer")
}