Question

A governance team wants to protect PII across hundreds of columns without manually attaching a masking policy to each column. They plan to classify columns with a tag such as 'pii_email' and have masking automatically applied wherever that tag is present. Which Snowflake capability lets them achieve this with a single policy definition?

Accepted Answer

Create a tag-based masking policy by assigning the masking policy to the tag, so any column tagged with that tag is automatically masked

Answer

Create a row access policy and attach it to each table containing PII columns

Answer

Apply a separate masking policy to each column individually using ALTER TABLE ... MODIFY COLUMN ... SET MASKING POLICY

Answer

Use object tagging alone, since tags automatically redact sensitive data once assigned to a column