Unified Policy Enforcement¶

This document provides guidelines for creating policies in the Snowflake policy repository to ensure proper unified policy enforcement. The key principle is that more restrictive policy items must be placed at the top of the policy.

Overview¶

Unified Policy Enforcement in Snowflake Connector requires careful ordering of policy items within a policy. The policy evaluation engine processes policy items from top to bottom, and the first matching condition determines the access level or masking behavior.

Policy Item Ordering Principles¶

1. Restrictiveness Hierarchy¶

Policy items should be ordered from most restrictive to least restrictive:

1. Most Restrictive: DENY or NULL masking
2. Moderately Restrictive: Specific masking functions (e.g., redact, hash)
3. Least Restrictive: ALLOW or no masking

Masking Policy Examples¶

✅ Correct Approach¶

1
2
3
4
5
6
7
8

Resource: Column {Customers.ssn}
Policy Items:
  1. Policy Item 1:
     Role: intern
     Masking Type: null
  2. Policy Item 2:
     Role: director
     Masking Type: redact4

Why this is correct: The intern role (more restrictive with null masking) is placed before the director role (less restrictive with redact4 masking).

❌ Wrong Approach¶

1
2
3
4
5
6
7
8

Resource: Column {Customers.ssn}
Policy Items:
  1. Policy Item 1:
     Role: director
     Masking Type: redact4
  2. Policy Item 2:
     Role: intern
     Masking Type: null

Why this is wrong: The director role is processed first, and if an intern also has director privileges, they would get redact4 masking instead of the intended null masking.

Comments