![[Report] Data AI Governance Achieved with Snowflake AI Agent Governance, Data Exfiltration Prevention, Ransomware Countermeasures, etc. #SWTTokyo26](https://images.ctfassets.net/ct0aopd36mqt/4kFYCMTvi9ucEtpiAfvm01/b605f81aa314b1fdbc86f8fee275fb43/eyecatch_snowflakeworldtourtokyo2026.webp?w=3840&fm=webp)
[Report] Data AI Governance Achieved with Snowflake AI Agent Governance, Data Exfiltration Prevention, Ransomware Countermeasures, etc. #SWTTokyo26
With the widespread adoption of AI, the scope of data and risks that organizations must manage are rapidly expanding.
In this session, we will explain best practices and the latest features for data security and AI governance provided by Snowflake.
In the first half, we will cover an explanation of data exfiltration attack processes based on real-world attack scenarios, and introduce advanced prevention measures utilizing data movement policies and Trust Center.
In the second half, centered on Snowflake Horizon Catalog, we will cover data governance features such as automatic detection of sensitive data using over 150 classification items, tag-based masking, ABAC, and access history auditing.
We will also introduce a governance framework for safely operating AI workloads, including governance automation, identity management for AI agents, prompt injection defense, and Cortex AI guardrails.
*Excerpted from the SNOWFLAKE WORLD TOUR 2026 event site
2026.09.14
This page has been translated by machine translation. View original
This is Kawabata.
"SNOWFLAKE WORLD TOUR 2026 - TOKYO" was held from September 10, 2026 to September 11, 2026.
This article is a report blog for the session
[Data & AI Governance with Snowflake: AI Agent Governance, Data Exfiltration Prevention, Ransomware Protection, and More]
【Update】
I was selected as a finalist in the "RISING COMMUNITY LEADER OF THE YEAR" category (APJ slot) of the Snowflake Community Awards.
Please see below for details.
Speaker
- Masaya Yanase
- Principal Security Architect, Snowflake Solution Engineering Division
Governance Challenges in the AI Era and Snowflake Horizon Catalog
- AI is now inseparable from business operations. At the same time, concerns are growing around "how to make AI agents behave correctly" and "how to use data safely"
- Since the emergence of ChatGPT, AI has evolved from chatbots to agents
- They don't just answer questions — they take actions, access external and confidential data, and make decisions on their own
- According to Snowflake's research, most customers identify governance and compliance as key challenges
- Snowflake Horizon Catalog is a foundation that provides integrated governance capabilities for data, AI, and security on Snowflake
- It combines data classification, tagging, access control, auditing, and controls for AI agents to achieve governance over data usage
- The three pillars of Horizon Catalog
- Discover: Understand what data exists, classify whether it contains personal information, and apply tags
- Protect: Tags alone are not enough — set policies tailored to the data
- Trust: In addition to auditing who used data and how, data quality and lineage are also important (Garbage in, garbage out)
Governance for Data
Automatic Classification and Custom Classification
- Automatic classification is GA and is being used by many customers
- It automatically classifies items such as names, email addresses, and salaries without having to inspect them one by one manually
- For company-specific sensitive data such as serial numbers and employee IDs, custom classification using regular expressions is available
Tag-Based Masking
-
Classification alone does not provide protection. Attach masking policies to tags, then apply those tags to multiple tables
- This enables bulk masking without writing policies for each individual table
-
This has been available for 3–4 years and is used by many customers
-
By tagging a table in advance, columns added later are also automatically protected — eliminating gaps and omissions is a major benefit
-
Attribute-based access management using ABAC
Sensitive Data Protection Using AI
- A new feature that uses the power of AI for more precise classification. Available in public preview
- The built-in rule-based classification has items it cannot cover, such as Japanese addresses
- Enabling AI mode allows AI to determine "this is an address"
Demo: From Classification to Masking
- A table containing names, email addresses, salaries, phone numbers, and Japanese addresses is first run through standard classification
- Names, email addresses, salaries, and similar fields are classified and masked for general roles via the masking policies pre-attached to tags
- Japanese addresses alone are not classified and remain unmasked
- When AI mode is enabled in the classification profile and reclassification is run, the address column is also detected and tagged as PII
- ACCOUNTADMIN can see the raw data, and when switching to a general user, addresses are also masked
- Japanese addresses can also be protected through the combination of AI mode and tag-based masking
For reference, here is an article from my past verification.
Governance for AI
Differentiating Policies with IS_AGENT_ACTIVATED
- A GA feature. You can write conditional expressions in policies such as "if agent, then...; if human, then..."
IS_AGENT_ACTIVATEDis a context function that determines whether an AI agent is active in the current execution context- Masking policies, row access policies, and more can be differentiated based on whether an agent is active or not
- Even with the same permissions, controls such as masking for agents or not returning rows can be applied
- In the official documentation, it is referenced as
SYS_CONTEXT('SNOWFLAKE$CURRENT', 'IS_AGENT_ACTIVATED')
Demo: Masking Only for Agent Access with the Same Permissions
- On the left, a human executes SQL in Snowsight; on the right, the same query is sent to Snowflake CoCo.
IS_AGENT_ACTIVATEDis FALSE on the left and TRUE on the right. The key point is that the value changes depending on the access path, even with the same permissions- Before the policy change, raw data is visible to both humans and agents
- The masking policy is changed to "return the string AGENT BLOCKED if TRUE." The INTEGER type policy is changed similarly
- When re-executed, the human sees the raw data while the agent receives only the masked values
- The same condition can be incorporated into other policies such as row access policies
For reference, here is an article from my past verification.
Cortex AI Guardrails for Sensitive Data Protection
- The existing Cortex AI Guardrails prevent attacks on AI such as prompt injection and jailbreaking
- The feature under development provides "output-side" protection that guards against sensitive data being included in AI output
- It has not yet reached private preview at this stage
Data Exfiltration Prevention
Overview of Exfiltration Prevention Features
- This applies not only to cases where humans exfiltrate data externally, but also to cases where agents attempt to move data outside
- Snowflake has multiple features for exfiltration prevention
- Data Movement Policies, the main feature of this session (GA in August 2026)
- External access controls that restrict destinations
- Trust Center scanners that detect where data is going
- ABAC
- The recommendation is to consider how to use these in combination
How It Works: Applying Row-Count-Based Rules via Tags
- Configuration is almost the same as masking policies — you write conditional expressions. The difference is that it can be controlled by "data volume (number of rows)"
- Controls such as allowing up to 100 rows but blocking 101 rows or more, or preventing external transfer, are possible
- The setup flow is: define a rule → create a policy → attach to a tag → attach the tag to a table
Demo: Five Patterns
For reference, here is an article from my past verification.
Ransomware and Unauthorized Operation Protection
Two Approaches
- To prevent destructive operations by insiders or agents as well as external attacks, an approval flow is inserted
- Backup: Snapshots can be taken that cannot be deleted or modified even by ACCOUNTADMIN
- Multi-party Approval (MPA): Without approver consent, even ACCOUNTADMIN cannot GRANT to other users
- Officially released (GA in August 2026 according to official documentation)
Multi-party Approval Flow
- The demo policy has three rules. It protects changes to MPA itself, disabling MFA, and granting privileged roles respectively
- Approvers and the required number of approvals (1 in the demo; default is 2) are defined in YAML
- The policy is applied to the account with
ALTER ACCOUNT SET, and the YAML content and application status can be verified - Executing a protected operation results in a block, and a request ID is issued
- A reason must be submitted with the request, and the operation can only be executed once an approver approves it
Demo: Approval and Rejection
- Attempting to GRANT ACCOUNTADMIN to another user is blocked and a request ID is displayed
- The message reads "Blocked by Multi-party Approval," prompting the user to submit a request
- The request ID is passed to the request function along with a reason. The status can also be checked from the Snowsight menu, and the request can be cancelled
- On the approver's Snowsight, pending approvals appear under "Requests and Approvals." After reviewing the content and approving, the same GRANT could be executed
- Since GRANT and REVOKE are separate operations, a request is required for each
- In the rejection case, an attempt to disable MPA was blocked, a request was submitted, but the approver rejected it as unjustified. Re-execution also failed as no approval was granted
- Even with sufficient permissions, operations cannot be executed without approval, which also prevents agents from arbitrarily granting roles
For reference, here is an article from my past verification.
Session Summary
- Discovering and protecting data is most important. Understanding what information exists in a table and how it should be protected can be achieved while reducing operational burden
- Governance through AI: The AI mode in automatic classification enables more precise classification
- You can also ask Snowflake CoCo "which tables have no masking policy?" — governance can be strengthened without writing SQL
- Governance for AI: Allowing AI to do things is powerful, but it is important to avoid "letting it do too much"
- Write conditions such as not showing data to agents, not allowing exfiltration, and not allowing unauthorized GRANTs into policies, and proceed safely with AI adoption
New Features Not Covered in the Session
Restricted Session Scope
This is a mechanism that sets a privilege ceiling on the permissions available only while an AI agent operates on behalf of a user. It does not modify RBAC and does not add permissions.
I believe this is a core feature for AI governance, so please be sure to check it out.
For reference, here is an article from my past verification.
Related Documentation
Here is the official documentation for the features introduced in the session.
Impressions
I attended the session "Data & AI Governance with Snowflake" on Day 2 of SNOWFLAKE WORLD TOUR TOKYO 2026. It was a session covering multi-layered defense through masking (how data is shown), Data Movement Policies (exfiltration), and Multi-party Approval (operations). These were organized around a single narrative of "governance for AI."
Since I had personally been verifying AI-related governance features, there were many points where I found myself nodding along in agreement, and I was glad to find that my thinking aligned with Snowflake's.
I hope this article serves as a useful reference for someone!