Snowflake, Column Level Security, Dynamic Data Masking.
('SYSADMIN') then pii_text when current_role() in ('USERADMIN') then regexp_replace(pii_text,substring(pii_text,1,7),'xxx-xx-') else '***Masked***' end; -- how to list all policies show masking policies; -- how to describe a masking policy desc masking policy mask_govt_id_pii; -- get_ddl function