Masking rules that redact column values in the grid, exports, AI and MCP #3615

Problem

Hiding a column is the only way to keep a value off the screen, and it covers one view:

• A hidden column is not fetched and is left out of copies (features/data-grid.mdx:70, :168). The choice is per table and per Mac.
• File > Export re-reads every table with SELECT * and ignores hidden columns (features/import-export.mdx:6).
• A query tab shows every column the query selects, and MCP tools such as execute_query and browse_table return the rows their own query reads.
• Hiding removes the column entirely. There is no way to see that a column holds an email, or that two rows share one, without seeing the address.

Working on production data during a screen share, a pairing session or a recorded demo puts customer data on screen, and the same rows can reach an export file, the AI context or an MCP client.

Proposed solution

• Masking rules per connection, or per connection tag such as production. A rule matches columns by table.column pattern (*.email, users.ssn, *password*) or by type, and picks a mask: full (••••), keep the last 4 characters, email (j•••@example.com), a stable hash so equal values still look equal, or NULL.
• Applied in one place after the fetch, so every reader gets the masked value: the data grid, a query tab's results, the row inspector, copy and Copy As, Export Results… and File > Export, charts, the AI context, and every MCP tool that returns rows. A query tab's column matches by the source table and column when the driver reports it, and by column name otherwise.
• A mask icon in the column header. A masked cell is read-only until Reveal, which asks for Touch ID and lasts for that tab.
• Rules sync with the connection, and a connection published to the Team Catalog carries them.
• The docs state the boundary plainly: masking hides values in TablePro, while filters and sorts still run on the server against the stored values. It does not replace database permissions.

Done when: one rule on *.email masks that column in each place listed above, and a test asserts every one of those paths.

Alternatives considered

Hide the column per table, or query through a database view that leaves the column out.

Platform

macOS

Related database type

N/A / General