Tokenization Access Policies

Tokenization access policies apply to tokenization today — Snowflake only. A tokenization access policy is a masking policy with detokenization, not a separate policy engine: it uses the same masking policy framework documented on Data Masking on Snowflake, applied to a column or tag that holds tokens.

The Three Access Levels

A masking policy with detokenization determines what a role sees when it queries a tokenized column or tag:

1. Token-Only Access (default) — the role sees the raw token. No detokenization occurs. This is the behavior when no detokenization policy is configured for a role.
2. Masked Detokenization — the value is detokenized, then masked — for example, showing only the last four digits of a detokenized SSN.
3. Full Detokenization — the role sees the original plaintext value. This must be explicitly configured.

These levels are configured per role and per column or tag through ALTR’s policy engine.

Prerequisites

To configure a masking policy with detokenization, you need:

• A Snowflake column or tag that already holds tokenized data. Detokenization policies don’t tokenize existing plaintext — the column or tag must already contain tokens.
• A Snowflake data source connected to ALTR.
• The column or tag labeled as tokenized when you connect it to ALTR. See Data Masking on Snowflake for connecting a column or tag.

Note

Tag-based detokenization requires the target column to be VARCHAR with a minimum length of 71 characters, to accommodate the token format. Columns with insufficient width can’t store tokens.

Configuring the Policy

To configure a masking policy with detokenization:

1. Connect the tokenized column or tag to ALTR, labeling it as tokenized. See Data Masking on Snowflake.
2. Apply an access policy to the column or tag, specifying which roles get Token-Only Access, Masked Detokenization, or Full Detokenization. See Data Masking for the general masking-policy framework.

Removing a masking policy with detokenization doesn’t detokenize the underlying data — previously tokenized values remain tokens until explicitly detokenized.

Critical Tokenization uses this same access model — see Critical Tokenization.