Intent-driven Governance: Protect Sensitive Data at Scale

Intent-driven Governance: Protect Sensitive Data at Scale

Skip to content

Blog / Product and Technology / Intent-Driven Governance: Protect Sensitive Data at Scale — Get Started in Minutes

Sep 9, 2026 / 7 min read Product and Technology Copy post link Open in Claude Open in ChatGPT

Intent-Driven Governance: Protect Sensitive Data at Scale — Get Started in Minutes

Raja Balakrishnan +1

As organizations expand their data and AI footprint, the pressure to govern sensitive data grows. Protecting thousands of sensitive objects — each subject to custom internal policies and regional and industry-specific regulations — is a complex and difficult task.

Part of the challenge is structural. Governance needs tooling to continuously detect, enforce and monitor policy against a stated intent. Without this foundation, it can become a blocker to organizations' data and AI goals.

At the same time, governing sensitive data is the job of multiple people. Data domain leads understand what makes data sensitive within their domain. Data governors define enterprise-wide policies. Platform administrators author production-grade SQL and hold the privileges to enforce controls. Each group has what the others need, but rarely have a shared workflow to connect them.

The result: sensitive data is not fully protected. It's at risk not just of exposure to incorrectly provisioned users and systems, but also from unintentional access and use by AI agents.

We're aiming to close that gap with the public preview of Intent-Driven Governance , an AI-native, collaborative workflow in Snowflake CoCo designed to quickly and continuously govern sensitive data at scale. You can describe what needs protecting in plain English, and Snowflake handles the rest: classifying sensitive columns, deploying masking policies and monitoring for drift, all with explicit human approvals at every stage.

Why is Intent-Driven Governance important?

We believe a data foundation has three pillars, which are the basis of Snowflake Horizon Catalog : Interoperability: Your data should be accessible regardless of where it lives: Snowflake tables, Apache Iceberg™, external engines, SaaS applications. Context : Your agents need to understand what they are reading: semantic views, lineage, descriptions, and popularity signals that are collected, enriched and automatically activated at query time. Governance and security : Every answer coming out of your agents should be backed by protected, auditable, compliant data.

Intent-Driven Governance is our answer to the third pillar at scale. It is the layer that helps make governance automated, continuous and reliable.

How Intent-Driven Governance works

Start with your broad intent and scope. Ask CoCo to:

"Set up Intent-Driven Governance for my CUSTOMER\_DATA database."

"Use Intent-Driven Governance to protect sensitive data in CLINICAL databases."

“Protect PII data pertaining to our employees.”

CoCo understands the request and triggers the Intent-Driven Governance workflow.

The workflow will: Ask what you want governed Present its observations Propose an English-language plan to enforce your intent Upon approval, produce SQL with Snowflake primitives and best practices Ask for approval and execute the plan

Building governance iteratively

Intent-Driven Governance follows a spec-driven development approach to enforce governance in an iterative, stage-gated workflow. Each stage produces one artifact, and every stage needs an explicit approval before moving to the next one or taking any action. We divide each iteration into five stages.

Stage #1: Observe . Establishes the baseline for the scope you chose: databases, roles, existing policies, tags, classification profiles and custom classifiers, plus what is currently unprotected. Shares a canonical observation\_summary.md that you can iterate on.

Stage #2: Understand intent . Records what you want protected, who should see it in the clear, and asks thoughtful questions to determine what to preserve and what to intentionally leave out of scope.

Stage #3: Build the governance spec. Converts intent into a plan: the spec maps each natural-language intent back to the control that satisfies, then outlines tags, policies and/or classification profiles that need to be created, how those will behave and the roles they'll affect. Describes the plan in plain English so it's easily understood by those who don't read SQL or understand Snowflake primitives.

Stage #4: Generate SQL . Creates the SQL file to implement the spec (once spec is approved): presents the SQL, allows you to download it, check into git, review it with your peers and iterate on it. Upon approval, adds non-mutating prechecks and writes rollback plan so changes can be reversed if necessary.

Stage #5: Execute and verify. Re-observes the account, checks live state against the spec, measures compliance and records a committed version as a starting point for the next iteration.

We've built this workflow with each artifact acting as a contract, following a spec-driven development paradigm that:

Builds on existing controls: The workflow understands existing tags (including custom tags), policies, classification profiles and metadata along with any additional context you share.

Requires explicit approval: Each step produces an artifact that requires human approval before it gets executed. Approval gates are deterministic, auditable and optional. You can choose to stop the workflow at any stage, take the artifact and continue the process manually.

Version controls: Each verified execution creates an immutable committed version that holds the observation summary, approved intent, governance spec, implementation SQL and execution summary. You can build up your governance just like you build software.

Remains auditable: The execution summary records the approved SQL and who approved it. Each statement is mapped to the spec item it implements.

Leverage context to enhance sensitive data protection

Every team has to answer “What counts as sensitive for us?” Data protection policies often need to accommodate industry and region-specific regulations, internal guidelines, domain-based nuances and bespoke rules.

Intent-Driven Governance leverages CoCo and your organization's internal context to address this. If you share your internal guidelines, policy documentation or industry-specific compliance guidelines with CoCo, this skill will incorporate your governance definition and turn...