> ## Documentation Index
> Fetch the complete documentation index at: https://docs.omni.co/llms.txt
> Use this file to discover all available pages before exploring further.

# mask_unless_access_grants

> Masks dimension values with MD5 hash when users don't meet specified access grants.

Defines a list of [access grants](/modeling/models/access-grants) for the dimension that determine whether values should be masked. When a user doesn't satisfy the specified access grants, dimension values are replaced with an MD5 hash. Unlike [`required_access_grants`](/modeling/dimensions/parameters/required-access-grants), which blocks access to the field entirely, this parameter allows users to see masked values.

This parameter is useful when you want to:

* Allow users to perform aggregations and analysis on sensitive data without exposing the actual values
* Enable joins and grouping on sensitive fields while protecting personally identifiable information (PII)
* Maintain data structure and relationships in queries while masking sensitive information

## Syntax

```yaml theme={null}
<dimension_name>:
  mask_unless_access_grants: [<grants_and_conditions>]
```

## Properties

<ParamField path="dimension_name" type="object[]">
  The name of the dimension.

  <Expandable title="dimension_name properties" defaultOpen="true">
    <ParamField path="mask_unless_access_grants" type="string[]">
      An array of access grant names that control data masking for the dimension. Each value must match an [access grant](/modeling/models/access-grants) defined in the model file. When the user doesn't satisfy the access grants, values are replaced with an MD5 hash.

      Use `|` for `OR` conditions and `&` for `AND` conditions within the same array element.
    </ParamField>
  </Expandable>
</ParamField>

## Examples

```yaml title="Mask data unless user has marketing access" theme={null}
customer_email:
  mask_unless_access_grants: [marketing]
```

```yaml title="Mask data unless user has marketing OR sales access" theme={null}
customer_email:
  mask_unless_access_grants: [marketing|sales]
```

```yaml title="Mask data unless user has marketing OR (sales AND product) access" theme={null}
customer_email:
  mask_unless_access_grants: [marketing|sales&product]
```