Design BigQuery policy-tag trees around few data classes

The page covers best practices for policy tags when using column-level access control or dynamic data masking in BigQuery. Policy tags are framed as an alternative to data governance tags (Resource Manager tags) for the same purposes. Organizations are told to start from the kinds of data they process—typically a small number of classes such as PII, financial data, and customer order history—and apply one class across many columns via a policy tag.

Access design comes next: different groups may need business-sensitive fields such as revenues and customer history versus PII such as phone numbers and addresses. Tags can be grouped in a tree; a root tag that contains others is sometimes useful. An example taxonomy groups types under High, Medium, and Low, with High holding leaf tags like Credit card, Government ID, and Biometric.

That hierarchy is shared meaning for sensitivity classes: the tag tree is the ontology of access categories, and column assignments are the bindings. Data governance and engineering teams manage fewer abstractions than one-off column ACLs, which keeps classification consistent for masking and query-time checks across the estate.