Public Sector Developer Guide

Public Sector Data Models
Public Sector Standard Objects
PublicSectrSltn Namespace
Public Sector APIs
Public Sector Standard Invocable Actions
Public Sector Tooling API Objects
Public Sector Metadata API Types
Public Sector Associated Objects
StandardValueSet Names and Standard Picklist Fields
Upload Files to Amazon S3
Accounting Subledger
Action Launcher
Business Rules Engine
Criteria-Based Search and Filter
Decision Explainer
Discovery Framework
Engagement
Group Membership and Households
Identity Verification
Intelligent Document Reader
Interest Tagging
Omnistudio Business REST APIs
Outcome Management Developer Guide
Record Alerts
Record Rollup Definitions
Service Process Studio
Tax and Revenue Management
Ingest Tax Data into Data 360
Identity Resolution for Tax and Revenue
Tax and Revenue Connect API
Data Governance Policies for Tax Data
Timeline
PDF

Data Governance Policies for Tax Data

Create DENY and MASK data governance policies to block or redact sensitive internal fields from taxpayer portal queries.

Before creating field-level policies, complete the portal access configuration:

  • DMO tagging with ExternalData.Visibility.Portal
  • Data access policy for Authenticated external user

See Configure Taxpayer Portal Access to Tax Data in Salesforce Help.

This access grants authenticated external users read access to all tagged DMOs. Field-level governance policies refine that access by blocking or masking specific fields that contain agency-internal data, such as fraud risk scores, audit flags, or caseworker notes that shouldn’t be visible to taxpayers.

Two policy types are available:

  • DENY: This field is blocked from taxpayer portal queries.
  • MASK: The field value is partially redacted—for example, an SSN may be returned as XXX-XX-6789. Use MASK when a partial value is still useful to the taxpayer but the full value must not be exposed.

Both policy types are scoped to the Authenticated external user authorization level, so they only affect portal user queries. Internal admin queries aren't affected.

Create a Field-Level DENY Policy

Block a sensitive field from appearing in taxpayer portal query results.

For general reference on data governance policy configuration, see Create an Object or Field-Level Access Policy in Data 360.

  1. In the Data 360 app, go to Data Governance, select Policies, and click New.
  2. Select Data Access, and then click Next.
  3. Enter a descriptive policy name, for example, Deny Fraud Score for External Users.
  4. For Authorization Level, select Authenticated External User, and then click Next.
  5. Set Resource to Field and Action to Deny Access.
  6. Configure when the action should take place.
  7. On the Users tab, set Take Action on to All Users.
  8. Click Save & Activate.
  9. Repeat for each field you want to deny.

Create a Field-Level MASK Policy

Redact a sensitive field in taxpayer portal query results while preserving a partial value.
  1. In the Data 360 app, go to Data Governance, select Policies, and click New.
  2. Select Data Access, and then click Next.
  3. Enter a descriptive policy name, for example, Mask SSN for External Users.
  4. For Authorization Level, select Authenticated External User, and then click Next.
  5. Set Resource to Field and Action to Mask.
  6. Select the masking format and the DMO field to mask.
  7. On the Users tab, set Take Action on to All Users.
  8. Click Save & Activate.

Test your policies by querying a governed field as a portal user. For MASK, verify that the response contains a partially redacted value. For DENY, confirm the SME-approved behavior before documenting the expected result.