Column-Based Masking

Column-based masking masks the values of a single, individually named column in query results, rather than every column carrying a shared tag. Each column policy targets one column by name and schema location, and maps user roles to the masking type applied when that role queries it.

Column-based masking applies to Snowflake data sources.

ALTR recommends tag-based masking over column-based masking for most cases: a tag-based policy covers every column carrying its tag as new columns are tagged, while a column-based policy needs a separate rule for each additional column. Column-based masking fits targeted exceptions — masking one specific column without tagging it.

Precedence Over Tag Policy

If both a tag-based policy and a column-based policy apply to the same column, the column-based policy takes precedence.

Caution

A column policy stores the column’s name and location when it’s created. If the column is later renamed or cloned, the policy continues to reference the original column, and the masking type it applies — along with the resulting query audit records — become inaccurate.

Create a Column Policy

To create a column policy:

1. Ensure the column is connected to ALTR.
2. Select Policy in the navigation menu.
3. Click Create Policy.
4. Locate the Column Policy card and click Create Policy.
5. Select the Column the policy affects. The policy applies masking to the values in this column.
6. Click Next.
7. Build the rule statement:
   1. Select the Role the rule affects.
   2. Select the Masking Type — the masking type applied to query results for that role. See Masking Types for the available masking types.
8. (Optional) Click Add an Alert to configure a policy alert for this rule. See Policy Alerts.
9. (Optional) Click + Rule Statement to add another rule to the policy.
10. (Optional) Disable Policy State to create the policy now and activate it later. To deactivate a policy after it’s created, first resolve all of its alerts. Deactivating a policy stops applying masking to the column.
11. Click Save. ALTR saves the policy.

Edit a Column Policy

To edit a column policy:

1. Select Policy in the navigation menu.
2. Expand the policy to edit.
3. Click Edit Policy.
4. Update the policy as needed.
5. Click Save. ALTR saves your changes.

Delete a Column Policy

Deleting a column policy removes its masking rules; values in the affected column are no longer masked for the roles the policy covered.

To delete a column policy:

1. Select Policy in the navigation menu.
2. Expand the policy to delete.
3. Click Edit Policy.
4. Click Delete Policy; a confirmation modal displays.
5. Click Delete Policy to confirm.

Note

How Snowflake invokes ALTR’s policy evaluation service at query time — the external function mechanism — is covered on Data Masking on Snowflake.