A developer is granted ownership of a table that has a masking policy. The developer's role is not able to see the masked dat

Question

Options

• AWill the developer be able to modify the table to read the masked data?
• BYes, because a table owner has full control and can unset masking policies.
• CYes, because masking policies only apply to cloned tables.
• DNo, because masking policies must always reference specific access roles.
• ENo, because ownership of a table does not include the ability to change masking policies

• A
  6% (1)
• D
  83% (15)
• E
  11% (2)

Explanation

In Snowflake's governance model, dynamic data masking policies are enforced at the column level and evaluate the querying user's active role at runtime. Owning a table does NOT grant the ability to alter or remove masking policies attached to it - that privilege belongs to roles with the APPLY MASKING POLICY privilege (typically a dedicated security/policy admin role). Because masking policies define visibility based on specific access roles, the developer's role - not having been listed in the policy conditions - will still see masked data. This separation of duties is intentional: table owners cannot circumvent data governance controls simply by virtue of ownership.

No community discussion yet for this question.