Question

A data governance team must ensure that a customer email column in the CUSTOMERS table shows real values only to users with the PII_ADMIN role, while all other users see a fully masked value. The solution must apply automatically to every query, including SELECT *, and must be reusable across multiple columns. Which Snowflake feature should the team implement?

Accepted Answer

A masking policy assigned to the email column that returns the unmasked value when CURRENT_ROLE() is PII_ADMIN and a masked string otherwise

Answer

A row access policy on the CUSTOMERS table that filters rows based on the querying user's role

Answer

A secure view over CUSTOMERS that applies a CASE expression on the email column, granted only to PII_ADMIN

Answer

An object tag applied to the email column identifying it as PII-sensitive