# Column-Level Security in Kafka: Selective Decryption

Same topic, same records, but each application sees only the fields it's allowed to see. Decryption interceptors in Conduktor Gateway are scoped to service accounts or groups: in this demo, one app can decrypt email but not last name, while the analytics group gets last name but not email.

## What You'll Learn

- Scope a decryption interceptor to a single service account, decrypting only the fields it needs
- Apply the same pattern to a group of applications with one interceptor
- Get column-level security for Kafka, enforced at the proxy instead of in every consumer