Row Access Policy

A Row Access Policy controls which rows of a table a user can see. Where a masking policy alters the values a query returns, a Row Access Policy removes entire rows from the result set, based on a column’s values and the querying user’s role. Row Access Policies apply to Snowflake data sources.

How a Row Access Policy Works

A Row Access Policy filters a table on one reference column — the column whose values determine which rows each role can see.

The policy’s statements map roles to the rows they can see. Each statement names a set of roles and either:

specific reference-column values those roles are allowed to see, or
all values, so those roles see every row with no filtering.

For example, a policy on a tenant_id column can give the role TENANT_A_ANALYST only the rows where tenant_id is A, while a statement with all values gives the ADMIN role every row.

Default Behavior

A role not covered by any statement sees zero rows. Every role that should see data must be included in a statement.

Use Cases

Regional restriction — EU users see only rows where the region column is EU.
Department scoping — each department’s roles see only that department’s rows.

Create a Row Access Policy

A table can have one Row Access Policy, and the reference column must already exist on the table before the policy is created.

To create a Row Access Policy:

Select Policy in the navigation menu.
Click Create Policy and choose the Row Access Policy type.
Select the database, schema, and table the policy applies to, and select the reference column.
Define rules mapping roles to the reference-column values they can see — give some roles all-access (every row) and others limited access to specific column values.
Save the policy.

A Row Access Policy can also be created through the ALTR API.

How Enforcement Works

For how a Row Access Policy is deployed to your Snowflake account — including when it takes effect — see Row Access Policy on Snowflake.