> ## Documentation Index
> Fetch the complete documentation index at: https://docs.k16solutions.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage column constraints

> Classify sensitive blueprint columns so role-based data access can mask protected values.

Column constraints classify sensitive data at the column level. DataX uses those classifications with role access rules to decide when returned values should be masked.

<Note>
  The current column-constraint editor applies to blueprint columns. Available classification names
  come from your workspace and can include categories such as PII or financial data.
</Note>

Before you begin, you need DataX Lakehouse availability and **Manage** permission under **Roles**.

## Classify columns

<Steps>
  <Step title="Open the editor">From **Lakehouse**, select **Column Constraints**.</Step>

  <Step title="Find an entity">
    Use **Search columns…**, then expand source folders and a blueprint to show its columns.
  </Step>

  <Step title="Apply classifications">
    Select the checkbox at the intersection of a column and each applicable classification.
  </Step>

  <Step title="Review pending changes">
    The toolbar reports the number of unsaved changes. Check each changed column before saving.
  </Step>

  <Step title="Save">Select **Save**. Wait for the success message before leaving the page.</Step>
</Steps>

Select **Reset** to discard all unsaved edits and return to the last loaded state.

## Understand masking

Classification and role access work together:

* A column remains part of the entity schema.
* A user who can query the entity can still see the column name.
* When that user's role cannot access the column's classification, DataX masks the protected values.

This lets one entity serve audiences with different sensitivity access. It does not replace correct entity-level access or source-system governance.

## Classification guidance

* Mark a classification only when the column actually contains that data.
* Classify derived values when they can still reveal protected information.
* Review copied and renamed columns after a blueprint change.
* Test with a role that should see the value and one that should receive masking.
* Recheck dashboards, worksheets, snapshots, and exports that use the column.

<Warning>
  Constraint changes affect access behavior across the workspace. Coordinate them with the
  administrator who manages role and entity access.
</Warning>

## If saving fails

1. Keep the page open and read the returned validation errors.
2. Confirm that the blueprint and version still exist.
3. Refresh if another person published a new version while you were editing.
4. Reapply the classifications to the current version.
5. Ask an administrator to verify that your role can manage data access.

Use [Catalog entity details](/datax/catalog/entity-details) to confirm that the published schema and constraint labels match your intended configuration.