Skip to main content

โ€‹
Description

Contains information about all masking policies defined in the system. Masking policies can only be created and applied in ClickHouse Cloud. In open-source builds the system.masking_policies table is always empty, but it is still present so that introspection queries such as SHOW MASKING POLICIES work and return an empty result instead of throwing.

โ€‹
Columns

  • name (String) โ€” Name of a masking policy.
  • short_name (String) โ€” Short name of a masking policy. Names of masking policies are compound, for example: mask_email ON mydb.mytable. Here โ€˜mask_email ON mydb.mytableโ€™ is the name of the masking policy, and โ€˜mask_emailโ€™ is its short name.
  • database (String) โ€” Database name.
  • table (String) โ€” Table name.
  • id (UUID) โ€” Masking policy ID.
  • storage (String) โ€” Name of the directory where the masking policy is stored.
  • update_assignments (Nullable(String)) โ€” UPDATE assignments that define how data should be masked, for example: email = โ€˜maskedโ€™, phone = โ€™--****โ€™. NULL if not set.
  • where_condition (Nullable(String)) โ€” Optional condition selecting the rows the mask is applied to. NULL if not set.
  • priority (Int64) โ€” Priority of the masking policy. Policies with higher priority are applied first.
  • apply_to_all (UInt8) โ€” Shows that the masking policy is set for all roles and/or users.
  • apply_to_list (Array(String)) โ€” List of the roles and/or users to which the masking policy is applied.
  • apply_to_except (Array(String)) โ€” The masking policy is applied to all roles and/or users except the listed ones.
Last modified on August 3, 2026