Oracle Data Redaction: Mask at Read Time, Prove It Isn't Access Control

The support rep sees ****-****-****-0001 on their screen and everyone relaxes. The card number is "masked," the demo looks compliant, the box gets ticked. Then someone runs an export, or a report buil