The Three-Layer RBAC Model

Snowflake's role-based access control is hierarchical: roles can be granted to other roles, forming a privilege graph that evaluates at query time. Done well, this scales to thousands of users without becoming unmanageable. Done badly, it becomes an opaque sprawl that no one wants to audit.

The pattern we deploy in customer engagements separates roles into three layers:

1. Access roles — fine-grained permissions on specific objects (e.g., READ_SALES_DB, WRITE_FINANCE_SCHEMA). One per object × privilege combination.
2. Functional roles — business-aligned roles that compose access roles (e.g., FINANCE_ANALYST, SALES_DATA_ENGINEER). Users are granted functional roles.
3. Administrative roles — platform operations (ACCOUNTADMIN, SECURITYADMIN, DATAOPS). Tightly scoped, MFA-required, audited.

The benefit is that adding a new dataset means creating new access roles and granting them to existing functional roles — no per-user changes. Removing a user from the company means SCIM revokes the functional roles, which cascade to all underlying access. Audit trails align cleanly with the role hierarchy.

Dynamic Data Masking and Row Access Policies

Two features handle the "same query, different result by user" requirement that GDPR and most internal data classifications demand.

Dynamic Data Masking attaches a policy to a column. The policy expression evaluates the current user's role and returns either the real value, a masked value (XXXX-XXXX-1234 for a card number), or NULL. The policy is applied at query time, so no copy of data with different masking exists.

CREATE MASKING POLICY mask_email AS
  (val STRING) RETURNS STRING ->
    CASE
      WHEN CURRENT_ROLE() IN ('SECURITY_ADMIN', 'PRIVACY_OFFICER') THEN val
      WHEN CURRENT_ROLE() IN ('ANALYST') THEN REGEXP_REPLACE(val, '.+@', '***@')
      ELSE '***'
    END;

ALTER TABLE customers MODIFY COLUMN email
  SET MASKING POLICY mask_email;

Row Access Policies filter rows based on the current user's context. Common pattern: each row carries a region column, and the policy returns only rows matching the regions the current user is entitled to:

CREATE ROW ACCESS POLICY region_filter AS
  (region STRING) RETURNS BOOLEAN ->
    EXISTS (
      SELECT 1 FROM access.user_regions
      WHERE user_name = CURRENT_USER()
        AND allowed_region = region
    );

ALTER TABLE orders ADD ROW ACCESS POLICY region_filter ON (region);

Together, these features replace the old pattern of building view-per-user-class hierarchies, which were brittle and hard to audit.

Audit, Lineage, and Object Tagging

Three features matter for audit and governance evidence.

• ACCOUNT_USAGE views — Snowflake's built-in audit catalog: QUERY_HISTORY, LOGIN_HISTORY, ACCESS_HISTORY, OBJECT_DEPENDENCIES. Retain 1 year by default, 7 years on Enterprise, longer with archival.
• Object Tagging — attach typed tags to columns, tables, schemas (e.g., data_classification = 'pii', retention = '7y'). Policies can reference tags, so a single masking policy applies everywhere a column is tagged 'pii'.
• Lineage — Snowflake exposes column-level lineage in ACCESS_HISTORY for query-derived columns, plus catalog integrations with Atlan, Collibra, and Alation for richer enterprise lineage.

The combination — tags drive policies, ACCESS_HISTORY records every read and write, lineage links downstream usage — is what makes a Snowflake account auditable. ACCESS_HISTORY in particular is the single most useful view for proving "no PII was read by user X on date Y."

Compliance Certifications

Snowflake holds the certifications enterprise buyers expect. As of 2026:

• SOC 1 / SOC 2 Type II / SOC 3 — annual reports available under NDA.
• ISO 27001 / 27017 / 27018 / 27701 — standard set for information security, cloud, PII, and privacy.
• PCI-DSS — Business Critical and VPS only.
• HIPAA / HITRUST CSF — Business Critical and VPS only, with BAA.
• FedRAMP Moderate / High — Snowflake Government Region, separate account creation flow.
• GDPR / Schrems II — EU regional deployments, customer-managed keys, no cross-region replication unless explicitly configured.
• IRAP, K-ISMS, German C5 — region-specific compliance for Australia, Korea, Germany.

Procurement teams should request the current SOC 2 Type II report and the customer-responsibility matrix early. The matrix lists which controls Snowflake operates and which the customer must operate (e.g., user provisioning, role design, network policy enforcement).

The Operating Model That Makes This Work

Features alone do not create governed warehouses. Three operating-model choices separate accounts that pass audits cleanly from accounts that struggle.

1. Tag-driven policy — every column gets a data classification tag at ingestion. Policies reference tags, never specific columns. New data inherits policy automatically.
2. Functional role discipline — users are never granted access roles directly. New users join groups in the IdP, SCIM syncs the group to a functional role, and the functional role's existing grants apply.
3. Periodic access review — quarterly review of role grants and functional-role membership, driven by reports against ACCOUNT_USAGE. Document the review, retain the evidence.

The enforcement of these three is operational, not technical. The tooling is there; the discipline is the differentiator.

How Opsio Helps

Opsio's snowflake delivery engagements set up the RBAC hierarchy, masking and row-access policy library, tag taxonomy, and the access-review tooling that customer teams continue to operate. We have delivered Snowflake governance models that pass ISO 27001, SOC 2, and Nordic financial supervisor audits. Customers in regulated sectors also work with us on broader managed cloud security covering the surrounding cloud account and on end-to-end data analytics programmes that build on the governed warehouse foundation.

For hands-on delivery, see data governance services.

For hands-on delivery, see Opsio India's data-protection practice.

For hands-on delivery, see Opsio's enterprise rag.

For hands-on delivery, see AI security compliance services with Opsio.

For hands-on delivery, see managed governance consulting.

For hands-on delivery, see how Opsio delivers managed security.