[viethqb]

Summary

Documents platform egret-data/platform#837: a mask rule by path that leaves Column empty now masks every column below its path on Trino and StarRocks. Before #837, Ranger applied it to no column.

Changes

• Masks and filters:
  • what an empty Column means;
  • the catalog-mask information_schema exclusion, and how the Policies tab lists it (wh.!information_schema.*.*);
  • StarRocks SELECT * (5204) on tables a whole-table, schema or catalog mask reaches;
  • Trino metadata tables under schema and catalog masks.
• Migrate policies: a hand-written masking policy with no column level is Blocked, and what to change.
• Upgrade: a new version note covering:
  • the boot recompile, with no migration;
  • the pre-upgrade GET /perm/overlaps step;
  • the 409 lockout and the inert masks for a legacy pair, with the exact Governance overview text;
  • what readers notice after the upgrade.

🤖 Generated with Claude Code