Data Access Governance: Test the Policy, Not the Dashboard

Create a principal manifest containing the human users, groups, service identities and temporary collaborators in the test. Record the group/role memberships active during each operation. A role name in a screenshot is not enough when inherited permissions, secondary roles or direct grants can change the effective result. Keep the privileged administrator account separate from the restricted account used to demonstrate denial.

Snowflake’s access-control documentation describes object ownership, role-based grants and user-based access, with role hierarchies and managed-access distinctions. Databricks documentation describes Unity Catalog securable objects and access-control capabilities. Those are implementation-specific concepts, not interchangeable policy languages. Our recommendation is to ask the operator to explain the effective permission chain in the actual product and version rather than translating every platform into the same checkbox.

For a proposed trial, assign one identity through a group, one through a service role and one through time-bounded access. Attempt a permitted and a prohibited operation for each. Preserve the identity, active membership, object, action, timestamp, policy/configuration version and observed outcome. If the platform cannot explain why an operation was allowed, that is an unresolved investigation even when the result happens to match the intended policy.

Use a synthetic marker in a sensitive column and a deliberately ordinary value nearby. Inspect the result available to the restricted role: raw detail, partial masking, an approved view, an aggregate or denial. Compare the observed fields with the policy’s intended transformation. A discovery classifier identifying the marker is a different observation from a query returning it, so retain both pieces of evidence without collapsing them into one success result.

Export is its own operation. A role may be allowed to query a view while downloading results is restricted by an application or contract. Test the export format and destination you actually intend to use. Inspect whether masked values remain masked, whether hidden columns reappear and whether an existing extract persists after access changes. Revoking a source grant does not prove that a previously downloaded copy has been deleted.

For AI consumers, trace what reaches retrieval and the model context. A masked database result can be combined with an unmasked document or tool response elsewhere in the workflow. Record the service identity, retrieved fields, external destinations and retention boundary. This is a proposed synthetic-marker review, not evidence that GovernAtlas has tested a vendor’s masking effectiveness, detection accuracy or protection against every disclosure path.

Use the matrix below to record your approved expectations and actual observations. The example role labels are editable; all permissions and observations begin unspecified. Select a role, record expected access and observed behaviour for each action, and add a non-sensitive evidence reference. The tool compares only resolved allow/deny pairs. An unspecified expectation or an unperformed test cannot become a match simply because a dropdown was left blank.

A mismatch identifies work to investigate, not a vulnerability finding or a vendor ranking. An allowed operation can be wrong because the policy expected denial; a denied operation can be wrong because a legitimate workflow required access. The matrix does not inspect an account, execute a query, grant permissions or upload results. Entries stay in this open page and disappear on reload; download the plain-text record before leaving.

Finish with a decision bounded to the tested identities, objects, paths and release. Retain the evidence that explains both matching and unexpected outcomes, name the owner of every unresolved gap and identify change triggers for repeat review. A new connector, inherited role, model integration or storage path can invalidate an earlier observation. The value of the pilot is an inspectable operating boundary, not a permanent platform-wide declaration that access is secure.