Field configuration¶

Navigate: Configure → Mappings → open a mapping → in the Field Mapping Detail card header, the sliders icon ("Configure All"). Direct route: /mappings/<id>/fields.

You can also click a single row in the Field Mapping Detail table to edit that one column in a slide-over.

Field configuration is where you decide what "equal" means for each column. It is the highest-leverage screen in the product and the one most worth understanding before an evaluation.

Requires the mapping.field_write permission (or the operator role). Without it the page is read-only and says so.

The grid¶

Column	What it controls
Field / Type	The column and its introspected type.
Compare Mode	How large objects and floats are compared. Renders a BLOB control, a float control, or `—`, depending on the column's type.
Excl Hash	Exclude from the proof phase. The column stops affecting pass/fail. Useful for genuinely volatile columns.
Excl Diff	Still prove equality, but never report this column cell-by-cell.
Sensitivity	Public / Confidential / Restricted. Affects masking in evidence.
Classification	Public / Internal / Confidential / Restricted / Regulated / PII. Drives who may see values.
Mask UI	Always redact in evidence viewers. Writes an audit entry.

Encrypted fields are always masked in evidence. A field with a decrypt expression is sensitive by definition — its plaintext is never stored in ev.*, regardless of any store_raw_diff_values setting, and there is no opt-out. Authorized users view values through Reveal on the Evidence page (evidence.read_raw, audited per view). See Evidence. | Order | Hash column order — lower first, blank means alphabetical. Must match on both sides; normally leave it alone. |

Select two or more rows to reveal the bulk action bar.

A bulk edit only changes the rows it can. Type-specific settings skip columns of the wrong type, and the page tells you how many were changed and how many were left alone — so bulk-setting "Hash" across a mixed selection reports that it touched only the large-object columns.

Two choices the editor forces you to make¶

Most settings are optional. Two are not, because the safe answer depends on your data and a silent default could produce a wrong result.

BLOB / binary columns — `Compare Mode` is required¶

For a large-object or binary column the editor shows ⚠ Required — pick a mode and disables Save for the whole page until you choose.

Mode	Behaviour	Cost
Hash	Content-exact. Reads the full column value.	Reads the object — may incur egress or scan cost.
Metadata only	Compares length and existence only.	Cheap.
Skip	Excludes the column from comparison entirely.	Free.
Full (expensive)	Downloads and compares byte-for-byte.	Highest.

Why you are forced to choose: Metadata only is content-blind. A change that preserves length — a corrected digit, a swapped flag — is invisible to it. That is a silent false pass, which is the one failure mode this platform exists to prevent. Making it a default would be a trap, so the product makes the cost/accuracy trade a conscious decision.

Note: plain TEXT counts as a large-object type here. An ordinary Postgres or MySQL TEXT column will block Save until you pick a mode — which surprises most people the first time.

JSON and XML columns use the same control but do not block save; they default to content-exact. For XML, be aware the comparison is whitespace-significant: if the two sides pretty-print differently, every row will differ. Choose Metadata only or Skip for reformatted-XML columns.

FLOAT / DOUBLE columns — `Compare Mode` is required¶

Mode	Behaviour
Exact	Byte-identical comparison. Uses the reference implementation, so it may pull data back from SQL Server, Snowflake, BigQuery, Oracle, DB2 or Redshift.
Decimal-in-float	Keeps the comparison in the warehouse when the column actually holds fixed-scale decimals stored in a float type.

See Float column handling for the full treatment.

Normalization overrides¶

Open the sliders icon on a row. These change canonicalization for that column only.

Setting	Values	Notes
Trim strings	on/off	Strips leading/trailing whitespace before hashing.
NULL = empty string	on/off	Treats `NULL` and `''` as equivalent.
Numeric scale	1–18	Decimal places kept before hashing, rounded half-up. Scale 0 is rejected — for `DECIMAL(n,0)` leave it unset and inherit the global scale. A live preview shows the effect, e.g. `1250.5 → 1250.500`.
Numeric tolerance	≥ 0	Absolute difference treated as equal.
Timestamp precision	Seconds / Milliseconds / Microseconds	Truncation before hashing.
Timezone	IANA name	Zone naive timestamps are normalised to. Default UTC.
Rounding mode	Default (half-away-from-zero), Banker's, Half toward zero, Truncate, Floor, Ceiling	Declares how your replication pipeline rounds when scale is reduced, so Paridity canonicalizes both sides the same way. Fixed-point columns only — for floats use Compare Mode.
Timestamp rounding	Truncate (default), Round half up, Round half even	Same idea for sub-second precision. Cannot be combined with a per-field timestamp precision — one timestamp quantum per mapping.
Canonical type override	Date / Timestamp	Forces the canonical type. Use `timestamp` for an Oracle `DATE` that carries meaningful time-of-day, or `date` to compare a timestamp date-only. Applies to both sides.

The reduced-precision acknowledgment¶

Setting a numeric tolerance, a per-field numeric scale, or a per-field timestamp precision relaxes exactness. The editor requires you to tick:

I acknowledge this field is compared at a per-field precision by policy

Save stays disabled until you do, and the acknowledgment is recorded in the run evidence so an auditor can see where exactness was traded away. Editing any of those three values withdraws the acknowledgment and you must re-confirm.

Watch out: the checkbox lives inside the collapsed Normalization panel. If you set a tolerance, collapse the panel, and hit Save, you get a toast but no inline hint — the blocking control is off-screen. Re-open the panel.

Transform chains¶

The ƒ button opens a chain editor: an ordered list of normalizations applied before hashing and diffing, validated live against both engines.

Available: trim (both/left/right), uppercase, lowercase, left/right pad, regex replace, NULL↔empty conversions, Unicode normalize (NFC/NFD/NFKC/NFKD), collation fold, date truncate, numeric quantize, and decimal separator normalize.

Symmetric by default. Switching to Separate source / target chains is an asymmetric configuration: it requires platform_admin and the change is audited. That gate exists because an asymmetric chain can make two genuinely different values compare equal.

Suppressive transforms — regex replace, the NULL conversions, date truncate, numeric quantize — can hide real differences, so each asks for a policy reference that auditors cross-check.

Validation runs as you type and tells you one of three things: the chain is valid with native pushdown on both engines; valid but forcing the reference implementation (slower, still correct); or invalid, with the reason.

Encrypted columns¶

Setting	Where	Notes
SQL decrypt expression	Field Config page (padlock icon)	Injected into the SELECT to decrypt before hashing. Keys resolve through the secrets backend — never hardcode credentials. Requires `platform_admin`; the change is audited.
Decrypt key	Canvas Inspector only	A secrets-backend URI. Resolved at run time, never persisted in config or evidence.
Python-side decrypt	read-only badge	Shows as `python-decrypt (<algo>)`. Configured outside this screen; a SQL decrypt expression cannot be combined with it.

Some per-field overrides are disabled on encrypted columns for engine pairs where the decrypt cast is not yet byte-verified. The control explains itself when this happens — leave it unset and the global default applies.

Things worth knowing before you evaluate¶

Saving rewrites every field. The save is a full replace of the mapping's field configuration, applied atomically. A single-column edit rewrites all rows — which is why the different editing surfaces all send the complete set.
There are three editing surfaces (the full page, the single-field slide-over, and the canvas inspector) and they do not expose identical fields. store_raw_diff_values appears only in the slide-over; the decrypt key only in the canvas inspector. Use the full page unless you need one of those.
A PII-classified column with masking off raises a visible warning but does not block save. It is advice, not a control.
per_field_diff_limit is set per column under Field overrides → Evidence limit (the slider icon on a field row). It caps how many differing cells are recorded for that column in a run. Leave it blank to use the mapping's per-column limit. Note that a value here replaces the mapping limit for that column rather than narrowing it — it can raise the cap as well as lower it.