A company's Snowflake account has multiple roles. Each role should have access only to data that resides in the given role's specific region. When creating a row access policy, which code snippet below will provide privileges to the role ALL_ACCESS_ROLE to see all rows regardless of region, while the other roles can only see rows for their own regions?

The goal is to create a row access policy that grants one specific role (ALLACCESSROLE) unrestricted access, while restricting all other roles based on a mapping table. The OR logical operator is essential for this. The policy expression 'ALLACCESSROLE' = currentrole() OR exists(...) evaluates to TRUE if either condition is met. For the ALLACCESSROLE, the first condition is TRUE, so all rows are returned. For any other role, the first condition is FALSE, and access is determined solely by the EXISTS subquery, which checks the entitlementtable for a valid role-region mapping.

A: The AND operator requires both conditions to be true, incorrectly forcing the ALLACCESSROLE to also have an entry in the entitlement table to see any data. B: This snippet only contains the logic for region-specific roles. It fails to include the special case allowing ALLACCESSROLE to see all rows. D: This policy only allows the ALLACCESSROLE to see data. All other roles would be denied access to all rows because the condition would always evaluate to FALSE.

1. Snowflake Documentation: CREATE ROW ACCESS POLICY. The documentation provides a specific example of this use case. Under the "Examples" section

the subsection "Allow a role to view all rows in a table protected by a row access policy" shows a policy using the OR condition to grant a manager role full access while applying filtering to other roles. This directly validates the logic in option C.

sql

create or replace row access policy salespolicy as (salesregion varchar) returns boolean ->

'salesmanager' = currentrole()

or

'salesregion' = salesregion

;

2. Snowflake Documentation: Introduction to Row Access Policies. This document explains that the policy body is a SQL expression that evaluates to TRUE or FALSE. The use of CURRENTROLE() is highlighted as the primary function for creating role-based dynamic policies. The logic in option C is a standard implementation pattern described in these principles.