Oracle Data Redaction: Mask at Read Time, Prove It Isn't Access Control

The support rep sees ****-****-****-0001 on their screen and everyone relaxes. The card number is "masked," the demo looks compliant, the box gets ticked. Then someone runs an export, or a report built on the same table, or reads the datafile off disk — and the full number is right there, exactly where it always was, unchanged. That gap between...