Struct MaskingSpec 

pub struct MaskingSpec {
    pub description: Option<String>,
    pub key: Option<String>,
    pub rules: Vec<MaskRule>,
}

Available on crate feature masking only.

The masking: config block: a declarative, destination-scoped policy that classifies sensitive fields (by field-name pattern, by value detector, or by explicit field list) and applies a masking action per page. The masking pass runs first — before the quality, contract, and schema-drift passes and before every sink write — so PII never reaches a sink, the DLQ, or a lineage sample unmasked.

Masking never fails a run or quarantines records: every matching field is rewritten in place. Rules are evaluated in declared order; for a given field, the first matching rule wins.

Fields

description: Option<String>

Human-readable description of the policy (documentation metadata).

key: Option<String>

Secret key for keyed hashing/tokenization (hash / tokenize actions). When present, masked values are HMAC-SHA256 keyed digests, so the mapping cannot be reversed by an attacker who lacks the key yet stays deterministic (equal inputs → equal tokens) so masked values remain joinable downstream. Pull it from a secrets manager (${vault:...} / ${aws-sm:...} / …) rather than hard-coding it.

When absent, hash / tokenize fall back to an unkeyed SHA-256 digest — still deterministic, but not secret (anyone can recompute it).

rules: Vec<MaskRule>

The masking rules. Must be non-empty. Evaluated in declared order; the first rule that matches a given field wins for that field.

Trait Implementations

impl Clone for MaskingSpec

fn clone(&self) -> MaskingSpec

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MaskingSpec

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for MaskingSpec

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for MaskingSpec

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl Serialize for MaskingSpec

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.