Forward-deployed data engineering.
Tag sensitive fields once, then attach those tags to roles to set who can read, write, or mask each slice of data.
Builds and maintains the data plane. Reads PII as masked, full access to internal data and pipelines.