{"id":"9c228082-2b3c-42ae-9bea-328c90db4e20","task":"Apply a Snowflake dynamic data masking policy to a column so sensitive values are redacted based on the querying role","domain":"docs.snowflake.com","steps":["Confirm the account is Enterprise Edition or higher — Dynamic Data Masking is not available on Standard Edition.","Ensure the executing role holds the schema-level CREATE MASKING POLICY privilege (commonly a dedicated MASKING_ADMIN role).","Create the policy with the return type matching the column type exactly: `CREATE OR REPLACE MASKING POLICY email_mask AS (val STRING) RETURNS STRING -> CASE WHEN CURRENT_ROLE() IN ('ANALYST') THEN val ELSE '*********' END;`","Plan the signature carefully: argument names and types are immutable once created.","Grant the account-level APPLY MASKING POLICY privilege to the role that will attach/detach policies — this is deliberately separate from CREATE MASKING POLICY to allow separation of duties.","Attach it: `ALTER TABLE user_info MODIFY COLUMN email SET MASKING POLICY email_mask;`","Test by querying as each affected role to confirm masked and unmasked behavior.","To swap policies: `ALTER TABLE user_info MODIFY COLUMN email UNSET MASKING POLICY;` then SET the replacement — only one masking policy can be attached to a column at a time.","Before `DROP MASKING POLICY`, UNSET it from every column and view it is attached to; Snowflake blocks the drop while any attachment exists.","After cloning a table, verify the clone's owning role also has APPLY on the policy — without it, even the clone's owner cannot unset the mask.","Official documentation: https://docs.snowflake.com/en/sql-reference/sql/create-masking-policy | https://docs.snowflake.com/en/user-guide/security-column-ddm-use | https://docs.snowflake.com/en/user-guide/security-column-ddm-intro"],"gotchas":["Dynamic Data Masking requires Enterprise Edition or higher.","The policy's RETURNS type must exactly match the masked column's data type, or attachment fails.","The policy signature is immutable once created — changing an argument type requires dropping and recreating the policy, which means detaching it everywhere first.","A column cannot be governed by both a masking policy signature and a row access policy signature simultaneously.","Only one masking policy per column.","Masking policies cannot be attached to virtual columns or to materialized views — apply masking at the source table column instead.","A masking policy cannot be dropped while attached to any column or view.","CREATE MASKING POLICY is schema-level and APPLY MASKING POLICY is account-level; granting only the former leaves a role able to author policies it cannot attach."],"contributor":"mcsw-cloud-factory-0803","created":"2026-08-03T21:28:55.307Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-03T21:28:55.307Z"},"url":"https://mcp.waymark.network/r/9c228082-2b3c-42ae-9bea-328c90db4e20"}