As organizations expand their data and AI footprint, the pressure to govern sensitive data grows. Protecting thousands of sensitive objects — each subject to custom internal policies and regional and industry-specific regulations — is a complex and difficult task.
Part of the challenge is structural. Governance needs tooling to continuously detect, enforce and monitor policy against a stated intent. Without this foundation, it can become a blocker to organizations' data and AI goals.
At the same time, governing sensitive data is the job of multiple people. Data domain leads understand what makes data sensitive within their domain. Data governors define enterprise-wide policies. Platform administrators author production-grade SQL and hold the privileges to enforce controls. Each group has what the others need, but rarely have a shared workflow to connect them.
The result: sensitive data is not fully protected. It's at risk not just of exposure to incorrectly provisioned users and systems, but also from unintentional access and use by AI agents.
We're aiming to close that gap with the public preview of Intent-Driven Governance, an AI-native, collaborative workflow in Snowflake CoCo designed to quickly and continuously govern sensitive data at scale. You can describe what needs protecting in plain English, and Snowflake handles the rest: classifying sensitive columns, deploying masking policies and monitoring for drift, all with explicit human approvals at every stage.
Why is Intent-Driven Governance important? #
We believe a data foundation has three pillars, which are the basis of Snowflake Horizon Catalog:
- Interoperability: Your data should be accessible regardless of where it lives: Snowflake tables, Apache Iceberg™, external engines, SaaS applications.
- Context : Your agents need to understand what they are reading: semantic views, lineage, descriptions, and popularity signals that are collected, enriched and automatically activated at query time.
- Governance and security : Every answer coming out of your agents should be backed by protected, auditable, compliant data.
Intent-Driven Governance is our answer to the third pillar at scale. It is the layer that helps make governance automated, continuous and reliable.
How Intent-Driven Governance works #
Start with your broad intent and scope. Ask CoCo to:
- "Set up Intent-Driven Governance for my CUSTOMER_DATA database."
- "Use Intent-Driven Governance to protect sensitive data in CLINICAL databases."
- “Protect PII data pertaining to our employees.”
CoCo understands the request and triggers the Intent-Driven Governance workflow.
The workflow will:
- Ask what you want governed
- Present its observations
- Propose an English-language plan to enforce your intent
- Upon approval, produce SQL with Snowflake primitives and best practices
- Ask for approval and execute the plan
Building governance iteratively #
Intent-Driven Governance follows a spec-driven development approach to enforce governance in an iterative, stage-gated workflow. Each stage produces one artifact, and every stage needs an explicit approval before moving to the next one or taking any action. We divide each iteration into five stages.
Stage #1: Observe. Establishes the baseline for the scope you chose: databases, roles, existing policies, tags, classification profiles and custom classifiers, plus what is currently unprotected. Shares a canonical observation_summary.md that you can iterate on.
Stage #2: Understand intent. Records what you want protected, who should see it in the clear, and asks thoughtful questions to determine what to preserve and what to intentionally leave out of scope.
Stage #3: Build the governance spec. Converts intent into a plan: the spec maps each natural-language intent back to the control that satisfies, then outlines tags, policies and/or classification profiles that need to be created, how those will behave and the roles they'll affect. Describes the plan in plain English so it's easily understood by those who don't read SQL or understand Snowflake primitives.
Stage #4: Generate SQL. Creates the SQL file to implement the spec (once spec is approved): presents the SQL, allows you to download it, check into git, review it with your peers and iterate on it. Upon approval, adds non-mutating prechecks and writes rollback plan so changes can be reversed if necessary.
Stage #5: Execute and verify. Re-observes the account, checks live state against the spec, measures compliance and records a committed version as a starting point for the next iteration.
We've built this workflow with each artifact acting as a contract, following a spec-driven development paradigm that:
- Builds on existing controls: The workflow understands existing tags (including custom tags), policies, classification profiles and metadata along with any additional context you share.
- Requires explicit approval: Each step produces an artifact that requires human approval before it gets executed. Approval gates are deterministic, auditable and optional. You can choose to stop the workflow at any stage, take the artifact and continue the process manually.
- Version controls: Each verified execution creates an immutable committed version that holds the observation summary, approved intent, governance spec, implementation SQL and execution summary. You can build up your governance just like you build software.
- Remains auditable: The execution summary records the approved SQL and who approved it. Each statement is mapped to the spec item it implements.
Leverage context to enhance sensitive data protection #
Every team has to answer “What counts as sensitive for us?” Data protection policies often need to accommodate industry and region-specific regulations, internal guidelines, domain-based nuances and bespoke rules.
Intent-Driven Governance leverages CoCo and your organization's internal context to address this. If you share your internal guidelines, policy documentation or industry-specific compliance guidelines with CoCo, this skill will incorporate your governance definition and turn it into controls that Snowflake can enforce. It will tag the right data, write policies that align with your needs and enforce them while keeping you in the loop.
“The early results were very promising. Using only metadata, including table structures and column names, along with our FERPA-related requirements, we were able to realize a 100% match using CoCo against our validated classifications without exposing the underlying data. We’re impressed by these initial results and excited about the potential to use this AI capability to accelerate our data governance efforts.”
Poorva Patil
Old Dominion University
Improve collaboration to streamline governance reviews and approvals #
Intent-Driven Governance can take you from zero to a fully governed state quickly. However, governance often involves solving a collaboration challenge, not just a technical one. Stakeholders from multiple teams must collaborate to operationalize governance. Data domain leads remain experts at understanding the underlying data, and how it should be protected. Platform administrators have elevated privileges, understand Snowflake primitives and can author SQL.
Intent-Driven Governance makes it possible for them to collaborate quickly and easily. The workflow is available across CoCo Desktop, CLI and UI, so users can choose to work in the format they prefer. Because Intent-Driven Governance persists versioned artifacts, the work is shareable. A data lead can open Snowflake CoWork, describe what needs protecting in business language, and review the governance spec. An account administrator can pick the same draft up in CoCo, review the exact SQL and the precheck evidence, and run it.
The workflow is also role-aware: If one role cannot perform an operation, it does not partially apply the change. It names the privileges required and prepares a package the right person can act on. The person who understands the data does not need the privileges to enforce it, and the person with the privileges does not have to guess at intent.
"There is nothing that Intent-Driven Governance is missing. We used to do this manually. I don't think we have the people to spend hours and hours validating every tag and policy."
Albert Nogues Sabater
NTT DATA
Drift detection supports continuous governance #
Protecting sensitive data is never done and dusted. Schema changes, new roles and policy modifications happen daily. Intent-Driven Governance can deploy drift detection tasks, on the schedule you define, that will:
- Check policies : Detects any modification to a masking policy DDL.
- Check classification profiles : Monitors classification configuration for changes to auto-classification behavior or scope.
- Check role inventory : Flags any role added or removed from the account since the approved snapshot.
When a high-severity change happens from your stated intent, an alert fires into your inbox or webhook. It shows you the drift in enforcement and how you may mitigate it.
Get started with Intent-Driven Governance and Snowflake CoCo #
Intent-Driven Governance is currently available in public preview for all accounts. Get started by asking CoCo to help you with your broad mandate to protect sensitive data at scale, or learn more by reading the documentation. We’re excited to see how you will use Intent-Driven Governance to lay a governed data foundation for your data and AI strategy.
This article contains forward-looking statements, including about our future product offerings, and are not commitments to deliver any product offerings. Actual results and offerings may differ and are subject to known and unknown risk and uncertainties. See our latest 10-Q for more information.