# Colum Masking Policies ... how to apply with variables **URL:** \ **Category:** Uncategorized\ **Created:** [September 4, 2024, 11:51am UTC](https://community.dremio.com/t/colum-masking-policies-how-to-apply-with-variables/12259 "2024-09-04T11:51:10Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Arnie](https://avatars.discourse-cdn.com/v4/letter/a/ba9def/32.png) [@Arnie](https://community.dremio.com/u/Arnie)\ **Post date:** [September 4, 2024, 11:51am UTC](https://community.dremio.com/t/colum-masking-policies-how-to-apply-with-variables/12259/1 "2024-09-04T11:51:10Z")
Hello Dremio documentation [Row-Access & Column-Masking | Dremio Documentation](https://docs.dremio.com/current/reference/sql/commands/row-column-policies#setting-a-masking-policy) explains how to set a policy on a column. Documented function protect\_ssn() contains hardcoded names and groups criterias … I tried to improve function with groupname in variables to create a new function : CREATE OR REPLACE FUNCTION new\_protect\_ssn(col VARCHAR, grp VARCHAR) RETURNS VARCHAR RETURN SELECT CASE WHEN “is\_member”(“grp”) THEN “col” ELSE ‘Not Authorized’ END New function works fine but I’m unable to set function via policy : ALTER TABLE “NASSERVER”.“FOLDER”.“TABLE” MODIFY COLUMN “COLUMN1” SET MASKING POLICY new\_protect\_ssn(“COLUMN1”,‘group’) Dremio returns an error Encountered “, 'group'” at line 3, column 58 which seems to be coherent with Dremio Documentation of SET MASKING POLICY because it expects only columns … Is there a workaround to have generic column masking function with variables for goupname or username compatible with SET MASKING POLICY ? ---
**Author:** ![Arnie](https://avatars.discourse-cdn.com/v4/letter/a/ba9def/32.png) [@Arnie](https://community.dremio.com/u/Arnie)\ **Post date:** [September 5, 2024, 12:28pm UTC](https://community.dremio.com/t/colum-masking-policies-how-to-apply-with-variables/12259/2 "2024-09-05T12:28:30Z")
I got an additional question : > **[Row-Access & Column-Masking | Dremio Documentation](https://docs.dremio.com/24.3.x/reference/sql/commands/row-column-policies/)** > > Row-access and column-masking policies may be applied to tables, views, and individual columns by a user with the ADMIN role based on the criteria set by user-defined functions (UDFs). Row access entails the exclusion or inclusion of specific records... How to understand that ALTER TABLE … MODIFY COLUMN points to 1 specific column while SET MASKING POLICY can point to multiple column that have to be names ? My need is to apply function to all columns. Should I use mulitple functions with dedicated MODIFY COLUMN and specify the same COLUMN in SET MASKING POLICY ? Also do you plan to use wildcards to apply policy to all columns (allowing to specify each column name). ---
**Author:** ![Benny\_Chow](https://sea2.discourse-cdn.com/flex020/user_avatar/community.dremio.com/benny_chow/32/5527_2.png) [@Benny\_Chow](https://community.dremio.com/u/Benny_Chow)\ **Post date:** [September 5, 2024, 10:23pm UTC](https://community.dremio.com/t/colum-masking-policies-how-to-apply-with-variables/12259/3 "2024-09-05T22:23:09Z")
I don’t think the UDF can take a constant as input so a workaround could be to wrap the table with a view and project a constant. The constant can then be fed into the UDF as your second argument. I think it would be better to wrap the table with a view anyway so that you have a level of indirection with downstream dependencies. ---
**Author:** ![Benny\_Chow](https://sea2.discourse-cdn.com/flex020/user_avatar/community.dremio.com/benny_chow/32/5527_2.png) [@Benny\_Chow](https://community.dremio.com/u/Benny_Chow)\ **Post date:** [September 5, 2024, 10:26pm UTC](https://community.dremio.com/t/colum-masking-policies-how-to-apply-with-variables/12259/4 "2024-09-05T22:26:16Z")
ALTER TABLE … MODIFY COLUMN … SET MASKING POLICY is applied to a single column at a time and can pass multiple columns as input to the UDF. There’s no current plan to use wildcards. Do other query engines support this? ---
**Author:** ![Arnie](https://avatars.discourse-cdn.com/v4/letter/a/ba9def/32.png) [@Arnie](https://community.dremio.com/u/Arnie)\ **Post date:** [September 9, 2024, 7:16am UTC](https://community.dremio.com/t/colum-masking-policies-how-to-apply-with-variables/12259/5 "2024-09-09T07:16:13Z")
Thanks Benny. Maybe Dremio does not support wildcards because it expects to respect data types. Then maybe to support wildcard per data type would be possible (eg : all test columns, all int columns …). Let’s see what Dremio plans. ---
**Author:** ![Arnie](https://avatars.discourse-cdn.com/v4/letter/a/ba9def/32.png) [@Arnie](https://community.dremio.com/u/Arnie)\ **Post date:** [September 11, 2024, 6:08am UTC](https://community.dremio.com/t/colum-masking-policies-how-to-apply-with-variables/12259/6 "2024-09-11T06:08:35Z")
To go on this thread - does anyone have a clearer definition of SET Masking Policy ? I don’t understand why it can take a list of different columns while MODIFY COLUMN can take only one columnname … does anyone have more expérience ?