# The PolicyInfo object

## Attributes

- `id` (string)
  Unique identifier of the policy. This field is output only and is generated by the system.
- `on_securable_type` (string)
  Type of the securable on which the policy is defined.
   Only `CATALOG`, `SCHEMA` and `TABLE` are supported at this moment.
   Required on create.
  Possible values: `CATALOG`, `SCHEMA`, `TABLE`, `STORAGE_CREDENTIAL`, `EXTERNAL_LOCATION`, `FUNCTION`, `SHARE`, `PROVIDER`, `RECIPIENT`, `CLEAN_ROOM`, `METASTORE`, `PIPELINE`, `VOLUME`, `CONNECTION`, `CREDENTIAL`, `EXTERNAL_METADATA`, `STAGING_TABLE`
- `on_securable_fullname` (string)
  Full name of the securable on which the policy is defined.
   Required on create.
- `name` (string)
  Name of the policy. Required on create and optional on update.
   To rename the policy, set `name` to a different value on update.
- `comment` (string)
  Optional description of the policy.
- `to_principals` (array of string)
  List of user or group names that the policy applies to.
   Required on create and optional on update.
- `except_principals` (array of string)
  Optional list of user or group names that should be excluded from the policy.
- `for_securable_type` (string)
  Type of securables that the policy should take effect on.
   Required on create and optional on update.
  Possible values: `CATALOG`, `SCHEMA`, `TABLE`, `STORAGE_CREDENTIAL`, `EXTERNAL_LOCATION`, `FUNCTION`, `SHARE`, `PROVIDER`, `RECIPIENT`, `CLEAN_ROOM`, `METASTORE`, `PIPELINE`, `VOLUME`, `CONNECTION`, `CREDENTIAL`, `EXTERNAL_METADATA`, `STAGING_TABLE`
- `when_condition` (string)
  Optional condition when the policy should take effect.
- `policy_type` (string)
  Type of the policy. Required on create.
  Possible values: `POLICY_TYPE_UNSPECIFIED`, `POLICY_TYPE_ROW_FILTER`, `POLICY_TYPE_COLUMN_MASK`, `POLICY_TYPE_GRANT`
- `row_filter` (object)
  Options for row filter policies. Valid only if `policy_type` is `POLICY_TYPE_ROW_FILTER`.
   Required on create and optional on update. When specified on update,
   the new options will replace the existing options as a whole.
  - `function_name` (string)
    The fully qualified name of the row filter function.
     The function is called on each row of the target table. It should return a boolean value
     indicating whether the row should be visible to the user.
     Required on create and update.
  - `using` (array of object)
    Optional list of column aliases or constant literals to be passed as arguments to the row filter function.
     The type of each column should match the positional argument of the row filter function.
    - `alias` (string)
      The alias of a matched column.
    - `constant` (string)
      A constant literal.
- `column_mask` (object)
  Options for column mask policies. Valid only if `policy_type` is `POLICY_TYPE_COLUMN_MASK`.
   Required on create and optional on update. When specified on update,
   the new options will replace the existing options as a whole.
  - `function_name` (string)
    The fully qualified name of the column mask function.
     The function is called on each row of the target table.
     The function's first argument and its return type should match the type of the masked column.
     Required on create and update.
  - `on_column` (string)
    The alias of the column to be masked. The alias must refer to one of matched columns.
     The values of the column is passed to the column mask function as the first argument.
     Required on create and update.
  - `using` (array of object)
    Optional list of column aliases or constant literals to be passed as additional arguments to the column mask function.
     The type of each column should match the positional argument of the column mask function.
    - `alias` (string)
      The alias of a matched column.
    - `constant` (string)
      A constant literal.
- `grant` (object)
  Options for grant policies. Valid only if `policy_type` is `POLICY_TYPE_GRANT`.
   Required on create and optional on update. When specified on update,
   the new options will replace the existing options as a whole.
  - `privileges` (array of string)
    List of privileges to grant.
     When any of these privileges are requested, the policy will grant access
     if the principal and condition match.
     Required on create and update.
- `match_columns` (array of object)
  Optional list of condition expressions used to match table columns.
   Only valid when `for_securable_type` is `TABLE`.
   When specified, the policy only applies to tables whose columns satisfy all match conditions.
  - `condition` (string)
    The condition expression used to match a table column.
  - `alias` (string)
    Optional alias of the matched column.
- `created_at` (int64)
  Time at which the policy was created, in epoch milliseconds. Output only.
- `created_by` (string)
  Username of the user who created the policy. Output only.
- `updated_at` (int64)
  Time at which the policy was last modified, in epoch milliseconds. Output only.
- `updated_by` (string)
  Username of the user who last modified the policy. Output only.

## Example

```json
{
  "id": "string",
  "on_securable_type": "string",
  "on_securable_fullname": "string",
  "name": "string",
  "comment": "string",
  "to_principals": [
    "string"
  ],
  "except_principals": [
    "string"
  ],
  "for_securable_type": "string",
  "when_condition": "string",
  "policy_type": "string",
  "row_filter": {
    "function_name": "string",
    "using": [
      {}
    ]
  },
  "column_mask": {
    "function_name": "string",
    "on_column": "string",
    "using": [
      {}
    ]
  },
  "grant": {
    "privileges": [
      "string"
    ]
  },
  "match_columns": [
    {
      "condition": "string",
      "alias": "string"
    }
  ],
  "created_at": 0,
  "created_by": "string",
  "updated_at": 0,
  "updated_by": "string"
}
```