Skip to main content
Masking precedence: Masking Exemption > Global Masking Rule > Column Masking.
Certain roles can grant masking exemption to users, groups, service accounts, and workload identities so they can access the unmasked data:
  • Built-in roles: Workspace Admin, DBA, Project Owner.
  • Custom roles: bb.policies.createMaskingExemptionPolicy, bb.policies.updateMaskingExemptionPolicy, bb.policies.deleteMaskingExemptionPolicy.
To grant masking exemption:
  1. Go to the project, click Data Access > Masking Exemptions.
  2. Click Grant Exemption.
  3. Under Resources, choose All databases, Use CEL Expression, or Manually select, and optionally set an expiration.
  4. Select the accounts, and click Confirm.
The account search only suggests users and groups. To exempt a service account or workload identity, type its full email (for example, ci-bot@service.bytebase.com) and select it from the dropdown.
Masking exemption is not supported for document databases (MongoDB and Elasticsearch). See Document Database Masking.