Restricted PII role

Is your feature request related to a problem?

Split out from #7620. As requested by some enterprise customers, some team members should be able to run analytics on PostHog freely but without having access to PII from end users (as it's not required and it can be a liability/compliance issue).

Describe the solution you'd like

Have a role that has no access to PII. They either don't see attributes that contain PII or see redacted data. The way to identify PII is tricky, we could rely on common regex patterns for stuff like emails, SSNs, ... but there's other stuff that's difficult to detect. We could allow admins to identify certain properties as PII sensitive.

Describe alternatives you've considered

• Restricting access to specific events/properties only.

Additional context

• S3gm3nt has an interesting governance product worth exploring.

Thank you for your feature request – we love each and every one!

No files, tests, or entry points are named. Start by reviewing the existing role and permissions model and the related issue #7620; the work is done when an analytics role can operate without exposing PII, with a defined approach for detecting or administratively marking sensitive properties.