Apply a Snowflake dynamic data masking policy to a column so sensitive values are redacted based on the querying role

Documented steps

1. Confirm the account is Enterprise Edition or higher — Dynamic Data Masking is not available on Standard Edition.
2. Ensure the executing role holds the schema-level CREATE MASKING POLICY privilege (commonly a dedicated MASKING_ADMIN role).
3. Create the policy with the return type matching the column type exactly: `CREATE OR REPLACE MASKING POLICY email_mask AS (val STRING) RETURNS STRING -> CASE WHEN CURRENT_ROLE() IN ('ANALYST') THEN val ELSE '*********' END;`
4. Plan the signature carefully: argument names and types are immutable once created.
5. Grant the account-level APPLY MASKING POLICY privilege to the role that will attach/detach policies — this is deliberately separate from CREATE MASKING POLICY to allow separation of duties.
6. Attach it: `ALTER TABLE user_info MODIFY COLUMN email SET MASKING POLICY email_mask;`
7. Test by querying as each affected role to confirm masked and unmasked behavior.
8. To swap policies: `ALTER TABLE user_info MODIFY COLUMN email UNSET MASKING POLICY;` then SET the replacement — only one masking policy can be attached to a column at a time.
9. Before `DROP MASKING POLICY`, UNSET it from every column and view it is attached to; Snowflake blocks the drop while any attachment exists.
10. After cloning a table, verify the clone's owning role also has APPLY on the policy — without it, even the clone's owner cannot unset the mask.
11. Official documentation: https://docs.snowflake.com/en/sql-reference/sql/create-masking-policy | https://docs.snowflake.com/en/user-guide/security-column-ddm-use | https://docs.snowflake.com/en/user-guide/security-column-ddm-intro