Aggregation of policy information for principals associated with a file system

An apparatus, comprising:

• one or more memories storing processor-executable code;
• and
• one or more processors coupled with the one or more memories and individually or collectively operable to execute the code to cause the apparatus to:
• obtain, by a data management system, a snapshot of a file system, wherein the file system comprises a plurality of files and a plurality of permission sets, and wherein the plurality of permission sets indicate, for respective files of the plurality of files, one or more access approvals for one or more associated principals from among a plurality of principals associated with the file system;
• scan, by the data management system, the plurality of files to identify unique pairs, wherein a unique pair comprises a unique combination of a respective permission set and a respective sensitive information type, and wherein a file of the plurality of files is associated with a respective unique pair based at least in part on an access control list set for the file and a sensitive information type included in the file respectively matching the respective permission set for the unique pair and the respective sensitive information type for the unique pair;
• store, by the data management system, a first mapping that maps the unique pairs to respective values, wherein a respective value for a unique pair is indicative of an amount of sensitive information, of the respective sensitive information type for the unique pair, that is included in one or more files associated with the unique pair;
• and
• identify, by the data management system, based at least in part on the first mapping and an evaluation of the plurality of permission sets, a respective set of sensitive data types included in files to which a principal from among the plurality of principals has access.

A non-transitory computer-readable medium storing code, the code comprising instructions executable by one or more processors to:

• obtain, by a data management system, a snapshot of a file system, wherein the file system comprises a plurality of files and a plurality of permission sets, and wherein the plurality of permission sets indicate, for respective files of the plurality of files, one or more access approvals for one or more associated principals from among a plurality of principals associated with the file system;
• scan, by the data management system, the plurality of files to identify unique pairs, wherein a unique pair comprises a unique combination of a respective permission set and a respective sensitive information type, and wherein a file of the plurality of files is associated with a respective unique pair based at least in part on a permission set for the file and a sensitive information type included in the file respectively matching the respective permission set for the unique pair and the respective sensitive information type for the unique pair;
• store, by the data management system, a first mapping that maps the unique pairs to respective values, wherein a respective value for a unique pair is indicative of an amount of sensitive information, of the respective sensitive information type for the unique pair, that is included in one or more files associated with the unique pair;
• and
• identify, by the data management system, based at least in part on the first mapping and an evaluation of the plurality of permission sets, a respective set of sensitive data types included in files to which a principal from among the plurality of principals has access.