Automated Data Security: Self-Service Access to Sensitive Data
In a 2024 AI Connect webinar brought to you by Satori, leaders from Strata Decision Technology and Satori explained how to grant self-service access to sensitive healthcare and financial data. They stressed automation, access lanes, dynamic masking and tying permissions to tickets.
By The AI Enterprise Magazine Team5 min read
Key takeaways
- Automate everything. Leitch said teams that don't automate access introduce too much human variation and frustration.
- Offer access lanes. Users choose a more secure path without approval or a more sensitive one with sign-off.
- Tie access to tickets. Strata grants client database access while a Salesforce case is open and revokes it when it closes.
- Use late binding controls. Apply dynamic masking at access time instead of building a static copy for each pattern.
- Make the secure way the easy way. Adoption depends on fitting security into daily workflows.
In a 2024 AI Connect webinar brought to you by Satori, two engineering leaders described how to give people fast access to sensitive data without giving up security or compliance. Mitchell Leitch, Senior Director of Engineering at Strata Decision Technology, and Yoav Cohen, co-founder and CTO of Satori, spoke with moderator Nechama Katan, Director of Innovative Data Analytics at Pfizer.
Strata supplies software to hospitals and health systems and handles patient, financial and electronic health record data. Their discussion centered on automation, just-in-time access and tying permissions to the work people already do.
Why is managing access to sensitive data so hard?
Leitch said Strata takes in data from electronic medical records and general ledger systems, which means both patient data and the financial health of hospitals. Staff need to see it to support customers, he said, so the company has to enable access while protecting it.
Cohen named three problems. Access requirements keep changing, so data prepared for one project stops fitting. Companies run many data platforms, each with its own access control model. And the problem is organizational: a company that once gave everyone access to all data must become compliant without losing user trust or productivity.
What does self-service data access really mean?
Leitch said the business case is speed. "We do not want to put policies and bureaucracy in the way of our team members doing their jobs," he said. Small approval delays add up in technical support.
Cohen asked the audience to think of self-service more broadly, as users picking from several access "lanes" for the same data. A user who does not need sensitive data can take a more secure lane without approval. A user who needs sensitive data gets approval from a manager or data owner first.
How do you balance security with data utility?
Cohen said access always carries risk, but decisions should also weigh business value, how long access is needed and what access level is required.
Technically, he recommended what he called late binding controls. Instead of building a separately masked copy of each table for each predicted access pattern, apply controls such as dynamic masking at the moment someone accesses the data.
Leitch's advice was blunt: "Automation is king." He said teams that do not automate everything will introduce too much human variation and frustrate users, and that failures should at least be documented and made painless.
What do automated access workflows look like?
Leitch described tying access to Salesforce support tickets. When a ticket is assigned and the team member joins it, he or she gets access to that client's database, and access ends when the ticket closes. The ticket also serves as documentation of why the data was accessed.
Cohen described engineers requesting production database access through a command line tool or portal, with elevated access for on-call fixes and every query tied to the reason given. He said the best use cases are those where "the security system is actually an enabler for productivity."
How should organizations assess risk and win adoption?
Cohen said Satori's posture management tool scans databases and shows users, data assets and the chains of role inheritance that grant access. He also pointed to Satori's open-source Universal Data Permissions Scanner on GitHub.
Leitch said a risk-led effort needs executive sponsorship, while a productivity-led one can grow from the bottom up.
Cohen quoted a customer's saying that you have to "make the secure way the easy way." Leitch agreed that adoption depends on ease and fitting into daily work.
What advice do they give for getting started?
Leitch said teams must intend to automate every step and reduce friction as much as possible. He urged security and IT teams to find partners in the business, then go "with humility" and learn how people access data, when and why. His team would have missed many requirements without sitting with colleagues, he said, and the first pass will not be final.
Cohen said empathy is key: on the day of the webinar he watched a new employee's first experience of Satori, which the company uses internally.
What objections do leaders raise?
Cohen described two kinds of company. In smaller ones, data access is a free-for-all and the objection is that people used to have access to everything. In larger ones, locked-down access moves slowly. The usual objection, he said, is that automation will slow people down, but often the opposite happens and skeptics become believers once they see the secure way be the easy way.
Leitch said teams should anticipate concerns and lead with empathy. With Satori, he said, users may only need to change a connection string, and Strata staff understood that their own health data could be in the data sets.
How does it integrate with other tools?
Asked whether it works on top of Databricks, Epic or other systems, Cohen said Satori was designed around universality, since companies change data platforms over time. He compared it to getting television by satellite or internet: the plumbing differs but the experience is the same. Satori integrates directly with Databricks' Unity Catalog and differently with a Postgres database, he said.
He also advised vendors to offer APIs, Terraform and identity provider integrations such as Okta, since user information lives there.
What are the final takeaways?
Leitch's closing message was "Automation and understanding who's accessing the data." Cohen said the work is easier than people expect: it need not be a waterfall of mapping and classifying everything first, and teams can start with their most important flows and expand in phases.
Hear more from data and AI leaders in 2027
AI Connect has 24 free live webinars on its 2027 schedule, including the AI × Enterprise Panel Series and Plug & Play Series. See /webinars/. The AI Enterprise Conference 2027 takes place Tuesday, August 31, 2027, at Pier Sixty in New York City (/events/ai-enterprise-conference/).
Frequently asked questions
What is self-service data access?
Panelists described it as letting users choose the access level they need, with the organization deciding what approvals each level requires, instead of one fixed policy.
What is just-in-time data access?
It means granting access for a specific purpose and time, such as an hour to fix a production bug, with every query logged against the stated reason.
How can data access be automated?
Strata ties access to a Salesforce support ticket so permissions start when a team member joins the case and end when it closes.
Why use dynamic masking instead of static copies?
Yoav Cohen said controls applied at access time avoid building a separate masked data set for each predicted access pattern.
This article is based on remarks by Mitchell Leitch, Senior Director of Engineering, Strata Decision Technology; Yoav Cohen, Co-Founder and CTO, Satori; moderator Nechama Katan, Director of Innovative Data Analytics, Pfizer at AI Connect webinar, 2024 on February 21, 2024. More coverage: Webinars.
Filed under: Security & Fraud, AI Governance & Trust, Data & AI Infrastructure
