A two-division business wants company benchmarks, but each division's revenue is confidential. RLS tests pass. Would you release the report?

Instruction: Senior-level, open-ended case. Several approaches can be defensible; explain your assumptions, recommendation, tradeoffs and what evidence would change your choice. Choose a plausible confidential metric, such as a division's revenue or a small team's compensation, and explain what information users already know. Treat any suppression or grouping rule as a policy agreed with the data owner, not an arbitrary threshold. Use 'I would' unless you have handled this situation yourself. For a mock interview, allow two minutes for your first answer, then 30 seconds to respond to the pressure-test twist. State what changed, your next action and what you cannot safely promise.

Context: This open-ended senior case assesses decision quality. Recognizes inference risk beyond row-access tests, makes the incompatible requirements explicit, and offers useful alternatives without claiming that a hidden visual or a simple rounding rule provides security.

Updated

Official answer available

Read the opening below, then unlock the full answer and practical guidance.

I'd clarify whether the confidentiality requirement covers figures that a user can calculate, as well as rows they can open. If someone can see their division's exact revenue and the exact company total, they can subtract one from the other. Correct RLS on the transaction table doesn't solve that disclosure through an unrestricted summary table...

Upgrade to view official answer

Related Questions