Translate lab documentation to English
Some checks failed
Repo Quality / structure (push) Has been cancelled
Terraform Validate / validate (push) Has been cancelled

This commit is contained in:
Rodrigo Pace
2026-05-08 14:50:52 -03:00
parent cde150b705
commit 52bf971b8b
33 changed files with 939 additions and 702 deletions

View File

@@ -1,30 +1,30 @@
# Runbook - 03 PII Row Column Cell
## Objetivo
## Objective
Demonstrar controle fino de PII em linhas, colunas e celulas: funcionario ve seu proprio registro, gerente ve subordinados com SSN oculto, e RH ve dados sensiveis.
Show fine-grained PII controls across rows, columns, and cells: an employee sees their own record, a manager sees direct reports with SSN hidden, and HR sees sensitive data.
## Valor De Seguranca
## Security Value
- Protege PII e dados salariais.
- Demonstra controle de coluna e celula, nao apenas RBAC simples.
- Ajuda em conversas de LGPD, privacidade, RH e segregacao de funcoes.
- Protects PII and salary data.
- Demonstrates column and cell-level access, not only simple RBAC.
- Supports privacy, HR, LGPD/GDPR, and segregation-of-duties conversations.
## Pre-Requisitos
## Prerequisites
- Banco Oracle AI Database compativel com Oracle Deep Data Security.
- SQLcl ou SQL*Plus.
- Usuario com privilegios para criar data grants.
- Oracle AI Database compatible with Oracle Deep Data Security.
- SQLcl or SQL*Plus.
- User with privileges to create data grants.
## Antes - Ambiente Vulneravel
## Before - Vulnerable Environment
1. Limpe o cenario:
1. Reset the scenario:
```sql
@scenarios/03-pii-row-column-cell/sql/99_reset.sql
```
2. Crie dados e personas, sem data grants:
2. Create data and personas without data grants:
```sql
@scenarios/03-pii-row-column-cell/sql/00_schema.sql
@@ -32,46 +32,46 @@ Demonstrar controle fino de PII em linhas, colunas e celulas: funcionario ve seu
@scenarios/03-pii-row-column-cell/sql/02_identities.sql
```
3. Execute a consulta ampla:
3. Run the broad query:
```sql
@scenarios/03-pii-row-column-cell/sql/04_test_queries.sql
```
## Resultado Esperado Antes
## Expected Result Before
- Todos os funcionarios aparecem.
- `SSN` e `SALARY` ficam visiveis para quem tiver acesso amplo ao objeto.
- Um gerente ou usuario operacional poderia ver PII alem do necessario se a aplicacao falhar.
- All employees are visible.
- `SSN` and `SALARY` are visible to users with broad object access.
- A manager or operational user could see more PII than required if the application fails.
## Depois - Aplicando Deep Data Security
## After - Applying Deep Data Security
1. Aplique data grants de funcionario, gerente e RH:
1. Apply employee, manager, and HR data grants:
```sql
@scenarios/03-pii-row-column-cell/sql/03_data_grants.sql
```
2. Execute a mesma consulta como `emma`, `marvin` e `victoria`:
2. Run the same query as `emma`, `marvin`, and `victoria`:
```sql
@scenarios/03-pii-row-column-cell/sql/04_test_queries.sql
```
## Resultado Esperado Depois
## Expected Result After
- `emma` ve somente seu proprio registro.
- `marvin` ve seu registro e subordinados, mas SSN dos subordinados aparece como `NULL`.
- `victoria` ve todos os registros por papel de RH.
- Atualizacao de telefone e permitida apenas na linha autorizada.
- `emma` sees only her own record.
- `marvin` sees his own record and direct reports, but direct-report SSN appears as `NULL`.
- `victoria` sees all records through the HR role.
- Phone updates are allowed only for the authorized row.
## Evidencias Para Demo
## Demo Evidence
- Screenshot mostrando `SSN` como `NULL` para gerente.
- Query de update de telefone funcionando no proprio registro.
- Explicacao de row, column e cell-level access.
- Screenshot showing `SSN` as `NULL` for a manager.
- Phone update query working only on the user's own record.
- Explanation of row, column, and cell-level access.
## Referencias Oficiais
## Official References
- Fine-Grained Data Authorization: https://docs.oracle.com/en/database/oracle/oracle-database/26/ddscg/fine-grained-data-authorization.html
- Create Data Grants: https://docs.oracle.com/en/database/oracle/oracle-database/26/ddscg/create-data-grants.html