Hi,

if I want the following in a tag based policy for Hive.

Allow for group A when tags=System1

Deny for group A when tags=System1 and Confidential

Exclude user X from Deny when tags=System1 and Confidential

It means I need a custom expression to combine the two tags, saying user X
only should see the Confidential data tagged with System1. The rest of the
people in group A should not see the Confidential data.

Does the Exclude from Deny take the expression like this into
consideration? I am not getting this to work. I get a behaviour where it
seems like the user is excluded from all the Deny policies.

Regards,
David

Reply via email to