Piiano Vault

# Allow server to store SSNs
[policies.AllowSSNWrite] 
operations = ["write"]
resources = ["customers/types/ssn"]
# Allow server to only read masked SSNs
[policies.AllowSSNMask]
operations = ["read"]
resources = ["customers/types/ssn.mask"]

The diagram below shows how Vault allows high-granularity ACLs.
SSNs are always protected, even if the server is fully compromised.

// Object Level Security with JWT Validation
function view(context, object, value) {
   token = JWT.parseAndValidate(context.param)
   // If JWT subject matches the object subject
   if (token && token.subject === object.subject) {
      return value;
   }
   return null;
}

// Allow access to an email only if user has consented 
// the desired access reason
function view(context, object, value) {
    // email_consent can be e.g. "Analytics,Marketing"
    const allowed_reasons = object.email_consent.split(",");
    // Check if the access reason is allowed
    if (allowed_reasons.includes(context.reason)) {
        return value;
    }
    return null;
}

// US admin can only access emails of US citizens
function view(context, object, value) {
    if (context.role === "Admin_US" && object.residency === "US") {
        return value;
    }
    return null;
}