Snowflake, Column Level Security, Dynamic Data Masking.
or replace masking policy card_number_pii as (card_number string) returns string -> case when current_role() in ('SYSADMIN') then card_number when current_role() in ('USERADMIN') then regexp_replace(card_number,substring(card_number,1,15),'xxxx-xxxx-xxxx-') else '***Card-No-Masked***' end; alter