Enable Filter-Level Handling of Restricted Fields in FDI Reports

Sheila Romane

Currently, our organization enforces data-level security by restricting access to sensitive fields such as Disability Status and Valid From Date. While this is essential for protecting personally identifiable information (PII), it creates a significant limitation in reporting workflows:

• Users with restricted access cannot run reports that include expression filters on these fields, even if they are not viewing the data itself.

This leads to:

• Operational inefficiency: Maintaining multiple versions of the same report increases administrative overhead and introduces risk of inconsistency.
• User confusion: Differentiating between reports based on access levels is cumbersome and error-prone.
• Reduced agility: Analysts and business users are slowed down by unnecessary report fragmentation.

Proposed Enhancement: Allow users with restricted access to run reports that include expression filters on restricted fields, as long as they are not exposed to the actual data values. This could be achieved by:

• Implementing a secure filter-handling mechanism that respects row-level security but does not block query execution.

Benefits:

• Streamlined reporting: One unified report can serve both restricted and unrestricted users.
• Improved governance: Reduces the need to manage multiple report versions, lowering the risk of misreporting.
• Scalable solution: Supports broader use cases involving other sensitive fields (e.g., ethnicity, veteran status, etc.).

Use Case Example: A report on workforce demographics includes Disability Status and Valid From Date. Users restricted from viewing disability data receive a query error due to an expression filter placed on Valid From Date to get the latest Disability information. In this case 2 reports are needed, one with Disability information and one without. This enhancement would allow a single report to serve both audiences securely.

Thank you,

Sheila Romane

Sr. Software Developer

Providence