What is Row Access Policy in Snowflake and how does it implement row-level security?

A Row Access Policy (RAP) is a Snowflake security object that transparently injects an additional filter predicate into every query that touches the protected table. From the querying user's perspective, their SQL is unchanged — they simply receive fewer rows. The policy's logic determines which rows are visible based on the current user's identity or role.

The policy body is a SQL Boolean expression referencing CURRENT_USER(), CURRENT_ROLE(), or IS_ROLE_IN_SESSION(). A common pattern uses a mapping table: the policy joins the mapping table to determine which regions or tenants the current role may see, then returns only those rows.

Multiple policies can be applied to a single table; all must return TRUE for a row to be visible (AND logic). Policies can also be applied to views. Row Access Policies are evaluated after column-level masking policies.

-- Mapping table: role -> allowed region
CREATE TABLE region_access_map (
  role_name VARCHAR,
  region    VARCHAR
);
INSERT INTO region_access_map VALUES
  ('EMEA_ANALYST', 'EMEA'),
  ('APAC_ANALYST', 'APAC'),
  ('GLOBAL_ANALYST', 'GLOBAL');

-- Row Access Policy: show all rows to GLOBAL_ANALYST,
-- otherwise filter by the mapped region
CREATE ROW ACCESS POLICY region_rap AS (row_region VARCHAR) RETURNS BOOLEAN ->
  EXISTS (
    SELECT 1 FROM region_access_map
    WHERE role_name = CURRENT_ROLE()
      AND (region = 'GLOBAL' OR region = row_region)
  );

-- Attach the policy to the orders table on the region column
ALTER TABLE orders
  ADD ROW ACCESS POLICY region_rap ON (region);