A decentralized governance approach lets individual teams define and apply data policies to the objects they manage. In a Snowflake row-access design, the DATA_ENGINEER role owns policy creation and application, while functional roles receive filtered access. section 10.2
A practical implementation separates policy administration from data consumption:
- Create a managed-access DG schema and grant governance privileges to the policy-owning role. section 10.2
- Create functional roles, grant them BAKERY_READ, and provide warehouse usage. section 10.2
- Define a row access policy that maps session roles to permitted departments, then attach it to the EMPLOYEE view. section 10.2
Role-filtered employee view
A policy can return TRUE for DATA_ANALYST_BREAD when DEPARTMENT = 'Bread' and for DATA_ANALYST_PASTRY when DEPARTMENT = 'Pastry'; DATA_ENGINEER receives an unrestricted result. Applying the policy to RPT.EMPLOYEE makes each analyst see only its department. section 10.2
Figure 10.2 Functional roles DATA_ANALYST_BREAD and DATA_ANALYST_PASTRY are granted the BAKERY_READ access role, which allows them to read data in the RPT schema. A row access policy is applied to the EMPLOYEE view in the RPT schema, filtering rows based on the user’s functional role.
Trace how functional roles inherit read access and how the row access policy filters the EMPLOYEE view. section 10.2
