What is column-level security in Snowflake (Dynamic Data Masking and Column-level Security policies)?

Column-level security in Snowflake is implemented through Dynamic Data Masking (DDM) policies. A masking policy defines a SQL expression — typically a CASE statement on CURRENT_ROLE() or IS_ROLE_IN_SESSION() — that returns either the real column value or a masked substitute depending on who is querying. The masking is applied at query runtime; the original data is always stored unmasked in storage.

Key properties: the same policy can be applied to many columns; the policy can be changed or replaced without touching the table DDL; a privileged role always sees the real value; less-privileged roles see a masked version (e.g., ****, NULL, a truncated value, or a hash). Policy application is transparent to the user — their SQL is unchanged, they simply receive different output.

A Conditional Masking Policy can additionally inspect other column values in the same row when deciding how to mask (e.g., only mask the SSN column if the is_pii flag is true). This makes the policies context-sensitive.

-- Create a masking policy that hides emails from non-privileged roles
CREATE MASKING POLICY email_mask AS (val STRING) RETURNS STRING ->
  CASE
    WHEN IS_ROLE_IN_SESSION('PII_VIEWER') THEN val
    ELSE REGEXP_REPLACE(val, '.+@', '****@')
  END;

-- Apply the policy to the email column
ALTER TABLE customers
  MODIFY COLUMN email
  SET MASKING POLICY email_mask;

-- Analyst (no PII_VIEWER role) sees: ****@example.com
-- PII_VIEWER role sees: alice@example.com