Data Classification

Data Classification allows administrators to assign a governance classification to each Casabase Cube cube.

Classification identifies the sensitivity or intended handling of the data represented by a cube and provides metadata that can be used during governance, compliance, privacy, and access reviews.

Supported classifications are:

Classification	Intended Use
PUBLIC	Data approved for public or unrestricted use.
INTERNAL	Data intended for internal organizational use.
CONFIDENTIAL	Sensitive business data requiring controlled handling.
RESTRICTED	Highly sensitive data requiring the strongest organizational controls.

The appropriate classification should be determined according to your organization’s data governance and information-handling policies.

Classification Is Governance Metadata

Data Classification is a governance label.

It does not itself grant, deny, or restrict access to cube data.

For example:

Cube: FINANCE
Classification: CONFIDENTIAL

does not automatically prevent users from querying the FINANCE cube.

Access is controlled separately through:

• Snowflake role grants
• Casabase Cube application roles
• Casabase Cube row-level security

Conceptually:

Data Classification
        │
        ▼
How should this data be treated?


Roles and Access Control
        │
        ▼
Who can access this data?

Classification and security should therefore be used together where appropriate, but they perform different functions.

See Roles and Privileges and Access Control for access enforcement.

Why Classify Cubes

Classification provides administrators with a consistent way to identify the sensitivity of the data represented by each cube.

This can support activities such as:

• Data inventory
• Governance reviews
• Privacy reviews
• Access reviews
• Compliance assessments
• Security reviews
• Administrative reporting
• Decommissioning and lifecycle reviews

For example, an administrator can identify cubes classified as CONFIDENTIAL or RESTRICTED and review whether the corresponding security configuration is appropriate.

Classification makes the intended data-handling posture explicit without embedding that policy directly into the cube’s security rules.

Classification Levels

PUBLIC

Use:

PUBLIC

for data that the organization considers suitable for public or broadly unrestricted use.

The classification itself does not provide access. Users still require the appropriate Snowflake and Casabase Cube application access.

INTERNAL

Use:

INTERNAL

for data intended for use within the organization.

This can include operational or business information that is not intended for public distribution but does not require the organization’s higher sensitivity classifications.

CONFIDENTIAL

Use:

CONFIDENTIAL

for sensitive business information requiring controlled handling.

Administrators should review the access configuration of Confidential cubes to ensure that the actual security posture is appropriate for the organization’s requirements.

RESTRICTED

Use:

RESTRICTED

for the organization’s most sensitive cube data.

Restricted classification identifies the expected governance posture but does not automatically enable security or create access rules.

Administrators should explicitly verify the roles and row-level security associated with Restricted cubes.

Setting a Classification

Administrators can assign a classification with:

CALL CUBE.SET_DATA_CLASSIFICATION(
    'FINANCE',
    'CONFIDENTIAL'
);

The procedure accepts:

P_CUBE_NAME
P_CLASSIFICATION

where P_CLASSIFICATION is one of:

PUBLIC
INTERNAL
CONFIDENTIAL
RESTRICTED

The procedure returns a status message indicating the result of the operation.

Example Classifications

An organization might classify its cubes as:

SALES_ANALYTICS       INTERNAL
FINANCE               CONFIDENTIAL
EXECUTIVE_REPORTING   RESTRICTED
PUBLIC_METRICS        PUBLIC

These classifications describe the intended governance treatment of each cube.

They do not imply that the corresponding security configuration has automatically been created.

Reviewing the Data Inventory

Use:

CALL CUBE.GET_DATA_INVENTORY();

to review the cubes managed by Casabase Cube and their governance characteristics.

The inventory includes:

Column	Description
CUBE_NAME	Name of the cube.
DATA_TABLE	Data table associated with the cube.
DATA_CLASSIFICATION	Current governance classification.
DIMENSION_COUNT	Number of dimensions associated with the cube.
HAS_SECURITY	Indicates whether row-level security is configured for the cube.
LAST_QUERIED	Most recent query activity associated with the cube.

The inventory provides a useful administrative view of both classification and security posture.

Classification and Security Posture

One useful governance review is to compare:

DATA_CLASSIFICATION

with:

HAS_SECURITY

For example:

CUBE_NAME             DATA_CLASSIFICATION   HAS_SECURITY
--------------------  --------------------  ------------
PUBLIC_METRICS        PUBLIC                FALSE
SALES_ANALYTICS       INTERNAL              FALSE
FINANCE               CONFIDENTIAL          TRUE
EXECUTIVE_REPORTING   RESTRICTED            TRUE

A configuration such as:

DATA_CLASSIFICATION = RESTRICTED
HAS_SECURITY         = FALSE

deserves administrative review.

It does not necessarily mean the cube is incorrectly secured because access can also be controlled through Snowflake and application roles. However, the combination should be intentional and consistent with the organization’s access-control requirements.

Similarly:

DATA_CLASSIFICATION = CONFIDENTIAL
HAS_SECURITY         = FALSE

should prompt administrators to confirm that the cube’s actual access model is appropriate.

Classification Does Not Enable Security

Setting:

CALL CUBE.SET_DATA_CLASSIFICATION(
    'FINANCE',
    'RESTRICTED'
);

does not automatically:

• Enable row-level security
• Create security rules
• Revoke existing access
• Change Snowflake role grants
• Change CUBE_PUBLIC or CUBE_ADMIN assignments
• Filter query results

If data access needs to be restricted, configure the appropriate access controls separately.

This distinction prevents governance metadata from being mistaken for an enforcement mechanism.

Data Inventory and Lifecycle Management

LAST_QUERIED in the data inventory can also help administrators identify cubes that may no longer be actively used.

For example, an inventory review might identify:

CUBE_NAME       CLASSIFICATION   LAST_QUERIED
--------------  ---------------  -------------------
LEGACY_PLAN     CONFIDENTIAL     2025-11-14
FINANCE         CONFIDENTIAL     2026-08-22
SALES           INTERNAL         2026-08-23

A cube that has not been queried for an extended period can be reviewed to determine whether it is still required.

This can support:

• Data lifecycle reviews
• Reduction of unnecessary governed data
• Decommissioning decisions
• Access cleanup
• Administrative housekeeping

The decision to decommission a cube should follow the organization’s normal retention and governance processes.

Classification and Compliance

Data Classification contributes to Casabase Cube’s compliance and privacy reporting.

Classification metadata can help administrators answer questions such as:

What cubes contain sensitive data?
          │
          ▼
How are those cubes classified?
          │
          ▼
Is security configured?
          │
          ▼
Who has access?
          │
          ▼
Does the configuration match policy?

This makes classification useful as an input to governance reviews rather than as an isolated administrative label.

See Compliance and Privacy for the broader reporting capabilities.

Privacy Report

Casabase Cube provides a privacy report that combines governance and security information.

Use:

CALL CUBE.GET_PRIVACY_REPORT();

The report includes information related to areas such as:

• Data classifications
• Security rules
• Access patterns
• Audit coverage
• Data-handling posture
• Governance recommendations

The report can identify issues requiring administrative review, including cubes that have not been classified.

GET_PRIVACY_REPORT returns the report as a JSON VARIANT.

The report is intended to support privacy and governance reviews rather than provide or certify compliance by itself.

Classification Review

Classification should be reviewed periodically and when the purpose or contents of a cube materially change.

A useful review process is:

Review Cube Purpose
       │
       ▼
Determine Data Sensitivity
       │
       ▼
Assign Classification
       │
       ▼
Review Access Controls
       │
       ▼
Validate Governance Posture

Administrators should consider whether:

• The cube has an appropriate classification.
• The classification still reflects the data being modeled.
• Sensitive cubes have appropriate access controls.
• Security configuration is consistent with organizational policy.
• Unused cubes should remain available.
• Newly created cubes have been classified.

Classification and Access Reviews

Classification can also help prioritize access reviews.

For example:

PUBLIC
   │
   └── Standard access review


INTERNAL
   │
   └── Internal-use review


CONFIDENTIAL
   │
   └── Enhanced access review


RESTRICTED
   │
   └── Highest-priority access review

The specific review requirements and frequency should follow the organization’s own policies.

Casabase Cube provides the classification metadata needed to identify and organize these reviews.

Recommended Practices

When using Data Classification:

• Classify every production cube.
• Use classifications consistently across the environment.
• Base classifications on organizational governance policies.
• Review CONFIDENTIAL and RESTRICTED cubes against their actual security configuration.
• Do not treat classification as an access-control mechanism.
• Review classifications when cube contents or business purposes change.
• Use the data inventory during periodic governance reviews.
• Investigate sensitive cubes where HAS_SECURITY = FALSE.
• Review LAST_QUERIED when evaluating unused or obsolete cubes.
• Include classification in periodic access and privacy reviews.

Key Principle

The most important distinction is:

Classification describes the sensitivity of the data. It does not enforce access to the data.

Use Data Classification to establish governance context and use roles and row-level security to enforce the organization’s access requirements.

Related Topics

• Administration Overview
• Roles and Privileges
• Access Control
• Compliance and Privacy
• Audit Log