Column-Level Security in Kafka

Same topic, same records, but each application sees only the fields it's allowed to see. Decryption interceptors in Conduktor Gateway are scoped to service accounts or groups: in this demo, one app can decrypt email but not last name, while the analytics group gets last name but not email.

What You'll Learn

• Scope a decryption interceptor to a single service account, decrypting only the fields it needs
• Apply the same pattern to a group of applications with one interceptor
• Get column-level security for Kafka, enforced at the proxy instead of in every consumer