Protecting Sensitive Data: Classification, Masking, and Row Access Policies Hands-On Lab

Locking down who can log in is only half the job. Once a user is inside Snowflake, most teams still rely on schema-level grants and good intentions to keep PII, financial data and other sensitive columns out of the wrong hands. As data, users and AI projects grow, those grants drift, and nobody can say for sure who can see a Social Security number. This lab is for data engineers, platform administrators and governance teams who want protection that follows the data automatically instead of being maintained by hand.

Snowflake's built-in data protection features layer together so access is enforced by policy, not guesswork. Sensitive data classification finds what you have. Tags label it. Tag-based masking, row access and projection policies then protect it everywhere it's queried, including new columns the moment they're tagged.

In this Hands-on Lab, we will be:

• Running automatic sensitive data classification to find PII across a schema
• Building tag-based masking policies so new sensitive columns are protected as soon as they're tagged
• Applying row access policies so each role only sees its own region or business unit
• Using projection policies to block columns from being selected at all
• Testing every policy by switching roles and seeing exactly what each user gets back

By the end of this lab, you'll understand how classification, tags and policies work together: classification finds the data, tags label it, and policies enforce protection anywhere it's queried. You'll know when to mask, when to filter rows and when to block a column entirely, and you'll leave with working policy code you can adapt to your own account and use to show auditors that sensitive data is protected by design.