This section describes how to confirm that the contents registered in the confidentiality matrix match the confidentiality objects and roles managed in the PostgreSQL system catalog. The method shown here is just an example.

The inspector must be granted SELECT privilege on tables with the pg_confidential_management_support extension and SELECT privilege on the confidentiality object and role information added to the subject confidentiality matrix in the system tables. At a minimum, the confidentiality management role for the confidentiality matrix being reviewed and superuser certainly have such privileges.

The confirmation procedure is divided into the following three phases. If you detect a discrepancy, use the audit log to investigate what caused the discrepancy. And fix it to match.

(1) Make sure the state of the confidentiality matrix is the same as the design

If you detect a mismatch, please restore the correct state by executing functions such as pgx_alter_confidential_level function provided by this extension.

• Attributes of the confidentiality matrix

  Check using the pgx_confidential_matrix table.

• Number of registered confidentiality levels and attributes of each confidentiality level

  Check the row that matches the clevmatid to be checked from the pgx_confidential_level table. To know the confidentiality matrix identifier, see cmatid in the pgx_confidential_matrix table.

• Number of registered confidentiality groups and attributes of each confidentiality group

  Check the row in the pgx_confidential_role table whose ccolmatid matches the identifier of the confidentiality matrix to be checked.

• Confidentiality group privileges set to confidentiality level

  Refer to the pgx_confidential_privileges table. However, in this table confidentiality levels and confidentiality groups are represented as identifiers. Join with pgx_confidential_level table and pgx_confidential_role table if you want to check by confidentiality level name or confidentiality group name.

(2) Verify correct confidentiality objects and roles registered

Confirm that the definition of the confidentiality management feature matches the definition of the confidentiality objects and roles. If you detect a mismatch, please restore the correct state by executing functions such as pgx_alter_confidential_level function provided by this extension.

• Is the number of confidentiality objects registered in the confidentiality level the same as designed?

• Do the attributes of each confidentiality object match the attributes of the confidentiality level to which it belongs?

  It is recommended to check these using pgx_get_attribute_of_objects function. Because this function gets the state of the confidentiality object from the PostgreSQL system catalog and outputs a table that can be compared with the definition. For the format of the table, refer to "B.7 Functions that Support Definition Referencing and Comparison with System Catalogs".

• Is the number of roles registered in the confidentiality group the same as designed?

• Do the attributes of each role match the attributes of the confidentiality group to which it belongs?

  It is recommended to check these using pgx_get_attribute_of_roles function.For the format of the table returned by a function that outputs authority information, such as this function, refer to "B.7 Functions that Support Definition Referencing and Comparison with System Catalogs".

(3) Check privilege of confidentiality objects

Verify that the roles granted access to confidentiality objects and what the privileges are are consistent with the definitions in the confidentiality matrix. A good help is to use the pgx_get_privileges_on_matrix function. For details on the output format, see "7.3.5 Granting Confidentiality Privileges to Confidentiality Groups".

If you want to focus on any confidentiality level or role, use the function below.

• pgx_get_privileges_on_level_and_group()

• pgx_get_privileges_on_object()

• pgx_get_privileges_on_role()

INSERT INTO temp_table_for_analysis SELECT pgx_get_privileges_on_matrix('matrix_foo')