Tag-based data governance auditing system

A system for implementing an object tagging framework for a database, comprising:

• one or more processors;
• and
• a memory storing instructions that, when executed by the one or more processors, cause the system to perform operations comprising:
• receiving from an administrator of the database, a tag creation command including a tag name;
• in response to the tag creation command, creating a tag for classifying sensitive information in objects of the database;
• granting an apply privilege of the tag to a data owner of an object of the database;
• in response to a bind command from the data owner, generating a tagged object based on the tag and the object of the database, the tagged object containing sensitive information;
• and
• in response to a request from the database administrator during a periodic audit, performing operations comprising:
• finding the tagged object of the database using the tag;
• determining whether the tagged object of the database is associated with a masking policy set by the administrator;
• and
• in response to determining the tagged object is unassociated with the masking policy, associating the tagged object with the masking policy to mask the sensitive information.

A non-transitory computer-readable storage medium, the computer-readable storage medium including instructions that when executed by a computer, cause the computer to perform operations comprising:

• receiving from an administrator of the database, a tag creation command including a tag name;
• in response to the tag creation command, creating a tag for classifying sensitive information in objects of the database;
• granting an apply privilege of the tag to a data owner of an object of the database;
• in response to a bind command from the data owner, generating a tagged object based on the tag and the object of the database, the tagged object containing sensitive information;
• and
• in response to a request from the database administrator during a periodic audit, performing operations comprising:
• finding the tagged object of the database using the tag;
• determining whether the tagged object of the database is associated with a masking policy set by the administrator;
• and
• in response to determining the tagged object is unassociated with the masking policy, associating the tagged object with the masking policy to mask the sensitive information.