<a id="multiple-encryption-rules-csfle"></a>

# Use Multiple Encryption Rules

Client-Side Field Level Encryption (CSFLE) allows you to safeguard sensitive data, such as personally identifiable
information (PII), by enabling field-level encryption at the producer and
consumer levels.

Each CSFLE encryption rule is uniquely defined by the combination of the schema
subject, the assigned tags, and the Key Encryption Key (KEK). This enables you
to apply different encryption rules to different fields within the same schema
by using distinct tags. For more about how to assign tags to fields, see
[Configure client-side field level encryption](client-side.md#configure-csfle).

#### IMPORTANT
CSFLE support for multiple encryption rules per schema is a Limited Availability
feature in Confluent Cloud. If you would like to participate in the Limited
Availability Program, contact your Confluent account team.
to participate in the Limited Availability Program, contact your Confluent
account team.

## Multiple rule considerations

Before using multiple encryption rules for a schema, review the following
important considerations:

* **API/CLI/Terraform only**: Support for multiple encryption rules per schema
  is available only through the REST API, Confluent CLI, and Terraform. There
  is no Cloud Console support.
* **Cost implications**: You will be charged for each rule as an extra cost. For
  example, if you use 3 encryption rules per schema, you will be charged for
  three rules. To help control costs, do not use this capability in an
  uncontrolled manner.
* **Performance testing**: Run performance and scale testing to understand the
  implications of using multiple rules.
* **Avoid overlapping rules**: Fields with two or more overlapping rules are
  encrypted based on all applicable rules, which could result in unexpected
  behavior. For example, if a field is tagged with both `PII` and `PHI` and
  you have defined an encryption rule for both tags, that field is
  encrypted twice. The consumer must have access to both KEKs to be able to
  decrypt the data. When you add new tags or new rules to an existing schema to
  make sure to avoid unintentionally creating overlapping rules.
* **Client versions**: Use the latest version of a client when
  implementing this feature.

## Prerequisites

To use CSFLE with multiple encryption rules, you must have the following
prerequisites:

- [Stream Governance Advanced package](../../../stream-governance/packages.md#stream-gov-packages) enabled
- A supported client

To learn more, see [Requirements](client-side.md#csfle-requirements).

## Enable Multiple Encryption Rules Support

To enable support for multiple encryption rules, send a PUT request to the
schema registry endpoint with a request body that sets `validateRules` to
`false`. This setting enables multiple encryption rules for the schema.

```none
curl -X PUT "SCHEMA_REGISTRY_ENDPOINT/config" \
  -H "Content-Type: application/json" \
  -d '{
    "validateRules": false
  }'
```

After this call, you can create multiple encryption rules for the same schema by
using the same schema subject and different tags and KEKs. To learn more about
using multiple rules, see [Rule ordering and its impact on DLQ](client-side.md#rule-ordering).

## Related content

- [Use Client-Side Field Level Encryption in Confluent Cloud](client-side.md#use-client-side-field-level-encryption)
- [Rule ordering and its impact on DLQ](client-side.md#rule-ordering)