*: add document for column-level masking policy feature by tiancaiamao · Pull Request #22613 · pingcap/docs

tiancaiamao · 2026-03-23T09:20:16Z

First-time contributors' checklist

I've signed the Contributor License Agreement, which is required for the repository owners to accept my contribution.

What is changed, added or deleted? (Required)

Which TiDB version(s) do your changes apply to? (Required)

Tips for choosing the affected version(s):

By default, CHOOSE MASTER ONLY so your changes will be applied to the next TiDB major or minor releases. If your PR involves a product feature behavior change or a compatibility change, CHOOSE THE AFFECTED RELEASE BRANCH(ES) AND MASTER.

For details, see tips for choosing the affected versions.

What is the related PR or file link(s)?

This PR is translated from:
Other reference link(s): *: add column-level masking policy feature document docs-cn#21454

Do your changes match any of the following descriptions?

Delete files
Change aliases
Need modification after applied to another branch
Might cause conflicts after applied to another branch

… Grafana This commit addresses issue #21768 by adding a new section to document the default login credentials for TiDB Dashboard and Grafana when using TiUP playground. Changes: - Add 'Access TiDB Dashboard and Grafana' section - Document TiDB Dashboard default credentials (root, empty password) - Document Grafana default credentials (admin/admin) - Add note about using updated root password if changed

gemini-code-assist · 2026-03-23T09:20:33Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces comprehensive documentation for the new column-level masking policy feature in TiDB. This feature is designed to enhance data security and compliance by allowing sensitive data to be masked at the column level, with masking rules configurable based on user roles and privileges. The documentation covers the feature's functionality, management, and various masking options, ensuring users can effectively implement and manage data protection.

Highlights

New Documentation for Column-Level Masking Policy: A comprehensive document has been added to explain the new column-level masking policy feature in TiDB, enhancing data security and compliance.
Detailed Feature Explanation: The new documentation provides an in-depth overview of the masking policy, including its purpose, key characteristics, and benefits for protecting sensitive data.
Policy Management and Syntax: Instructions are provided for creating, modifying, enabling, disabling, and dropping masking policies, along with the necessary SQL syntax and required privileges.
Built-in Masking Functions: Four dedicated built-in functions (MASK_PARTIAL, MASK_FULL, MASK_NULL, MASK_DATE) are detailed, offering various methods for data redaction with examples for different data types.
Conditional Masking and Restrictions: The document explains how to implement conditional masking based on user identity (current_user()) and roles (current_role()), and how to use the RESTRICT ON clause to prevent data exfiltration during specific SQL operations.
Behavioral Considerations and Limitations: Key aspects such as at-result masking, supported column types, and current limitations (e.g., no masking on views or temporary tables) are clearly outlined.
Table of Contents Update: The main Table of Contents (TOC.md) has been updated to include a direct link to the new column-level masking policy documentation.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces comprehensive documentation for TiDB's new Column-Level Masking Policy feature, including its overview, required privileges, syntax for creation and management, details on built-in masking functions (MASK_PARTIAL, MASK_FULL, MASK_NULL, MASK_DATE), conditional masking based on user/role, RESTRICT ON semantics, behavior considerations, and MySQL compatibility notes. The review comments suggest improvements to enhance the documentation's clarity, maintain an active voice, and ensure consistent markdown formatting.

tiancaiamao · 2026-04-16T01:42:49Z

Ref pingcap/tidb#65744

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

ti-chi-bot · 2026-05-09T06:33:31Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from qiancai. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Co-authored-by: tiancaiamao <tiancaiamao@gmail.com>

…s-cn#21454

github-actions · 2026-06-09T09:21:29Z

Auto-sync failed

Source PR: https://github.com/pingcap/docs-cn/pull/21454/files/e83787336ac1427368e6e86196a7def3133e57d4..fc90d60de2812fd073a664777d25894218c5ed35
Target PR: #22613

Translated changes were not pushed to the target branch. Please check the workflow logs for details.

Synced from: https://github.com/pingcap/docs-cn/pull/21454/files/e83787336ac1427368e6e86196a7def3133e57d4..fc90d60de2812fd073a664777d25894218c5ed35 Target PR: #22613 AI Provider: azure Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

github-actions · 2026-06-09T11:01:34Z

Auto-sync completed successfully

Source PR: https://github.com/pingcap/docs-cn/pull/21454/files/e83787336ac1427368e6e86196a7def3133e57d4..fc90d60de2812fd073a664777d25894218c5ed35
Target PR: #22613

English documentation has been updated based on Chinese documentation changes.

Co-Authored-By: Grace Cai <qqzczy@126.com>

qiancai · 2026-06-10T03:11:37Z

/gemini review

gemini-code-assist · 2026-06-10T03:11:41Z

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

qiancai · 2026-06-10T04:53:47Z

+| `TableName` | The name of the target table. |
+| `Identifier` (in parentheses) | The name of the target column. Each column can be bound to at most one masking policy. |
+| `Expression` | The masking expression. You can use built-in masking functions such as `MASK_FULL`, `MASK_PARTIAL`, `MASK_NULL`, and `MASK_DATE`, or use a custom expression containing `CURRENT_USER()` or `CURRENT_ROLE()` to implement identity-based conditional masking. |
+| `RESTRICT ON (...)` | Optional. Restricts specific operations on the masked column to prevent the original data from being obtained indirectly through these operations. The operations that can be restricted include `INSERT INTO SELECT`, `UPDATE SELECT`, `DELETE SELECT`, and `CTAS`. |


Suggested change

| `RESTRICT ON (...)` | Optional. Restricts specific operations on the masked column to prevent the original data from being obtained indirectly through these operations. The operations that can be restricted include `INSERT INTO SELECT`, `UPDATE SELECT`, `DELETE SELECT`, and `CTAS`. |

| `RESTRICT ON (...)` | Optional. Restricts specific operations on the masked column to prevent the original data from being obtained indirectly through these operations. The operations that can be restricted include `INSERT_INTO_SELECT`, `UPDATE_SELECT`, `DELETE_SELECT`, and `CTAS`. |

qiancai · 2026-06-10T04:56:36Z

+
+# CREATE MASKING POLICY
+
+`CREATE MASKING POLICY` creates a [data masking policy](column-level-masking-policy.md) for columns in a table. After you enable a masking policy for a column, TiDB masks the results of that column according to the policy definition when returning query results, preventing sensitive data from being viewed by unauthorized users.


Suggested change

`CREATE MASKING POLICY` creates a [data masking policy](column-level-masking-policy.md) for columns in a table. After you enable a masking policy for a column, TiDB masks the results of that column according to the policy definition when returning query results, preventing sensitive data from being viewed by unauthorized users.

`CREATE MASKING POLICY` creates a [data masking policy](/column-level-masking-policy.md) for columns in a table. After you enable a masking policy for a column, TiDB masks the results of that column according to the policy definition when returning query results, preventing sensitive data from being viewed by unauthorized users.

qiancai · 2026-06-10T04:57:18Z

+
+### Filter results using the WHERE clause
+
+You can also use the `WHERE` clause to filter masking policies that meet specific conditions. For example, you can view enabled masking policies on the `employee` table as follows:


Suggested change

You can also use the `WHERE` clause to filter masking policies that meet specific conditions. For example, you can view enabled masking policies on the `employee` table as follows:

You can also use the `WHERE` clause to filter masking policies that meet specific conditions. For example, you can view enabled masking policies on the `employees` table as follows:

qiancai · 2026-06-10T04:57:58Z


+### Manage column-level masking policies
+
+You can use `ALTER TABLE` to manage [column-level masking policies](column-level-masking-policy.md) on tables, including adding, enabling, disabling, modifying, and dropping masking policies.


Suggested change

You can use `ALTER TABLE` to manage [column-level masking policies](column-level-masking-policy.md) on tables, including adding, enabling, disabling, modifying, and dropping masking policies.

You can use `ALTER TABLE` to manage [column-level masking policies](/column-level-masking-policy.md) on tables, including adding, enabling, disabling, modifying, and dropping masking policies.

qiancai · 2026-06-10T04:59:08Z

+
+# SHOW MASKING POLICIES
+
+The `SHOW MASKING POLICIES` statement lets you view information about the [Column-level masking policies](column-level-masking-policy.md) defined on a specified table.


Suggested change

The `SHOW MASKING POLICIES` statement lets you view information about the [Column-level masking policies](column-level-masking-policy.md) defined on a specified table.

The `SHOW MASKING POLICIES` statement lets you view information about the [Column-level masking policies](/column-level-masking-policy.md) defined on a specified table.

bb7133

LGTM

ti-chi-bot · 2026-07-01T05:20:45Z

@bb7133: adding LGTM is restricted to approvers and reviewers in OWNERS files.

Details

In response to this:

LGTM

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

qiancai · 2026-07-17T02:06:11Z

hold this PR because the related code is not fully ready according to @tiancaiamao

tiancaiamao added 3 commits March 11, 2026 18:14

*: add document for column-level masking policy feature

45f08a7

Merge branch 'master' into column-masking-policy

cadf28d

ti-chi-bot Bot added the missing-translation-status This PR does not have translation status info. label Mar 23, 2026

ti-chi-bot Bot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Mar 23, 2026

tiancaiamao mentioned this pull request Mar 23, 2026

*: add column-level masking policy feature document pingcap/docs-cn#21454

Open

14 tasks

gemini-code-assist Bot reviewed Mar 23, 2026

View reviewed changes

Comment thread column-level-masking-policy.md Outdated

Comment thread column-level-masking-policy.md

Comment thread column-level-masking-policy.md Outdated

Comment thread column-level-masking-policy.md Outdated

Comment thread column-level-masking-policy.md Outdated

qiancai added the v9.0-beta.3 This PR/issue applies to TiDB v9.0-beta.3. label Mar 24, 2026

tiancaiamao mentioned this pull request Apr 16, 2026

Support server-side column masking feature pingcap/tidb#65744

Open

2 tasks

tiancaiamao commented Apr 16, 2026

View reviewed changes

Comment thread column-level-masking-policy.md Outdated

tiancaiamao commented Apr 16, 2026

View reviewed changes

Comment thread column-level-masking-policy.md Outdated

tiancaiamao commented Apr 16, 2026

View reviewed changes

Comment thread column-level-masking-policy.md Outdated

qiancai self-assigned this May 8, 2026

Apply suggestion from @gemini-code-assist[bot]

4a339a7

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

tiancaiamao and others added 3 commits May 9, 2026 14:35

Apply suggestions from code review

e4a9860

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Co-authored-by: tiancaiamao <tiancaiamao@gmail.com>

Merge branch 'master' into HEAD

596d5ba

address comment

601198b

tiancaiamao requested a review from bb7133 May 9, 2026 07:38

sync the EN content according to the latest ZH content in pingcap/doc…

dc69955

…s-cn#21454

qiancai force-pushed the column-masking-policy branch from 9fa5c36 to dc69955 Compare May 26, 2026 06:57

qiancai added 2 commits June 9, 2026 19:47

fix translation issues caused by bugs in ai-pr-translator

6636763

Co-Authored-By: Grace Cai <qqzczy@126.com>

refine translation

67df3d3

qiancai added 2 commits June 10, 2026 11:15

Merge branch 'master' into column-masking-policy

5178ef1

Update sql-statement-overview.md

6604e10

qiancai reviewed Jun 10, 2026

View reviewed changes

bb7133 approved these changes Jul 1, 2026

View reviewed changes

qiancai added 2 commits July 17, 2026 10:11

docs: align masking policy examples and syntax

4d834ea

docs: defer masking policy syntax update

0fb5ff5

	\| `RESTRICT ON (...)` \| Optional. Restricts specific operations on the masked column to prevent the original data from being obtained indirectly through these operations. The operations that can be restricted include `INSERT INTO SELECT`, `UPDATE SELECT`, `DELETE SELECT`, and `CTAS`. \|
	\| `RESTRICT ON (...)` \| Optional. Restricts specific operations on the masked column to prevent the original data from being obtained indirectly through these operations. The operations that can be restricted include `INSERT_INTO_SELECT`, `UPDATE_SELECT`, `DELETE_SELECT`, and `CTAS`. \|


		# CREATE MASKING POLICY

		`CREATE MASKING POLICY` creates a [data masking policy](column-level-masking-policy.md) for columns in a table. After you enable a masking policy for a column, TiDB masks the results of that column according to the policy definition when returning query results, preventing sensitive data from being viewed by unauthorized users.


		### Filter results using the WHERE clause

		You can also use the `WHERE` clause to filter masking policies that meet specific conditions. For example, you can view enabled masking policies on the `employee` table as follows:


		### Manage column-level masking policies

		You can use `ALTER TABLE` to manage [column-level masking policies](column-level-masking-policy.md) on tables, including adding, enabling, disabling, modifying, and dropping masking policies.


		# SHOW MASKING POLICIES

		The `SHOW MASKING POLICIES` statement lets you view information about the [Column-level masking policies](column-level-masking-policy.md) defined on a specified table.

Uh oh!

Conversation

tiancaiamao commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

First-time contributors' checklist

What is changed, added or deleted? (Required)

Which TiDB version(s) do your changes apply to? (Required)

What is the related PR or file link(s)?

Do your changes match any of the following descriptions?

Uh oh!

gemini-code-assist Bot commented Mar 23, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tiancaiamao commented Apr 16, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ti-chi-bot Bot commented May 9, 2026

Uh oh!

github-actions Bot commented Jun 9, 2026

Uh oh!

github-actions Bot commented Jun 9, 2026

Uh oh!

qiancai commented Jun 10, 2026

Uh oh!

gemini-code-assist Bot commented Jun 10, 2026

Uh oh!

qiancai Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

qiancai Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

qiancai Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

qiancai Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

qiancai Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

bb7133 left a comment

Choose a reason for hiding this comment

Uh oh!

ti-chi-bot Bot commented Jul 1, 2026

Uh oh!

qiancai commented Jul 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

tiancaiamao commented Mar 23, 2026 •

edited

Loading