A team masks national identity numbers inside each BI tool's data model so analysts see only the last four digits. Security asks them to move the masking into the warehouse instead. Why does the location of the rule matter more than the rule itself?

The mechanism

A control protects exactly the paths it sits on. Masking applied inside a BI tool's semantic model is applied when that tool builds a query. It is not applied when an analyst connects a notebook with the same credentials, when a scheduled export runs, when a second BI tool is trialled, or when someone uses the warehouse's own console.

The number of query paths into a warehouse only ever goes up, and each new one silently opts out of every control that lives above the warehouse. The rule is correct and the placement makes it optional.

Moving it to the warehouse inverts the default. A masking policy attached to the column applies to every session that reads it, so a new tool arrives pre-governed rather than needing to be found and configured. The governed path stops being a path and becomes the only path.

Why the other options fail

• "Warehouses mask faster." Performance is not the argument, and in some cases a masking policy costs a little on every read. Trading a small cost for universal coverage is the point.
• "BI tools cannot express the rule correctly." They generally can, and often with a better interface than the warehouse offers. Expressiveness is not the weakness; reach is.
• "It removes the need to classify the column." The opposite: a warehouse policy has to be attached to something, and that something is a classification or a tag. Classification is the prerequisite, not the casualty. A platform without it can only write policies column by column, which is where the drift starts.

What this costs, and when not to do it

Warehouse-level policy is harder to develop against: an engineer debugging a transformation sees masked values and cannot tell a masking artefact from a data bug. The usual answer is a break-glass role with logged, time-limited access, which is more machinery than a small team may want.

Push the control down to where it cannot be bypassed, and keep the layer above for presentation. The exception worth naming: where the sensitive value never needs to leave one system at all, the strongest control is not masking it on read but not copying it in the first place. A column that was never ingested needs no policy, no audit and no break-glass path, and that option is usually dismissed too early.