Alter Standard Table - Policies

Last updated: January 27, 2026

Modifies security and privacy policies on standard tables, including row access, aggregation, and join policies.

Known limitations:

This change type does not support automatic rollback.
Snowflake snapshots created with Liquibase Secure 5.1 are incompatible with earlier versions due to enhanced object type detection for TABLES and VIEWS. Regenerate all snapshots with 5.1 after upgrading to avoid false differences in diff and diff-changelog operations.

Available attributes

Attribute	Type	Description	Required
`catalogName`	String	Name of the catalog (database) containing the table	No
`schemaName`	String	Name of the schema containing the table	No
`tableName`	String	Name of the table to alter	Yes
`ifExists`	Boolean	Only execute if the table exists	No

Row access policy

Controls row-level access to data based on user attributes.

alterRowAccessPolicy nested attributes

Attribute	Type	Description	Required
`policyName`	String	Name of the row access policy	No*
`on`	String	Column(s) the policy applies to	No
`dropPolicy`	Boolean	If true, drops the current policy	No*
`dropAllPolicies`	Boolean	If true, drops all policies	No*

*Specify either policyName to add/modify or dropPolicy/dropAllPolicies to remove.

<?xml version="1.0" encoding="UTF-8"?>
<databaseChangeLog
        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
        xmlns:pro-snowflake="http://www.liquibase.org/xml/ns/pro-snowflake"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-latest.xsd
        http://www.liquibase.org/xml/ns/pro-snowflake
        http://www.liquibase.org/xml/ns/pro-snowflake/liquibase-pro-snowflake-latest.xsd">

    <!-- Add row access policy -->
    <changeSet id="add-row-access-policy" author="examples">
        <pro-snowflake:alterStandardTable tableName="SENSITIVE_CUSTOMER_DATA">
            <pro-snowflake:alterRowAccessPolicy
                policyName="CUSTOMER_ACCESS_POLICY"
                on="USER_ID"/>
        </pro-snowflake:alterStandardTable>
    </changeSet>

    <!-- Drop row access policy -->
    <changeSet id="drop-row-access-policy" author="examples">
        <pro-snowflake:alterStandardTable tableName="SENSITIVE_CUSTOMER_DATA">
            <pro-snowflake:alterRowAccessPolicy dropPolicy="true"/>
        </pro-snowflake:alterStandardTable>
    </changeSet>

</databaseChangeLog>

{
  "databaseChangeLog": [
    {
      "changeSet": {
        "id": "add-row-access-policy",
        "author": "examples",
        "changes": [
          {
            "alterStandardTable": {
              "tableName": "SENSITIVE_CUSTOMER_DATA",
              "alterRowAccessPolicy": {
                "policyName": "CUSTOMER_ACCESS_POLICY",
                "on": "USER_ID"
              }
            }
          }
        ]
      }
    },
    {
      "changeSet": {
        "id": "drop-row-access-policy",
        "author": "examples",
        "changes": [
          {
            "alterStandardTable": {
              "tableName": "SENSITIVE_CUSTOMER_DATA",
              "alterRowAccessPolicy": {
                "dropPolicy": true
              }
            }
          }
        ]
      }
    }
  ]
}

databaseChangeLog:
  # Add row access policy
  - changeSet:
      id: add-row-access-policy
      author: examples
      changes:
        - alterStandardTable:
            tableName: SENSITIVE_CUSTOMER_DATA
            alterRowAccessPolicy:
              policyName: CUSTOMER_ACCESS_POLICY
              on: USER_ID

  # Drop row access policy
  - changeSet:
      id: drop-row-access-policy
      author: examples
      changes:
        - alterStandardTable:
            tableName: SENSITIVE_CUSTOMER_DATA
            alterRowAccessPolicy:
              dropPolicy: true

--liquibase formatted sql

--changeset examples:add-row-access-policy
-- Add row access policy
ALTER TABLE MYDB.PUBLIC.SENSITIVE_CUSTOMER_DATA
  ADD ROW ACCESS POLICY CUSTOMER_ACCESS_POLICY ON (USER_ID);

--changeset examples:drop-row-access-policy
-- Drop row access policy
ALTER TABLE MYDB.PUBLIC.SENSITIVE_CUSTOMER_DATA
  DROP ROW ACCESS POLICY CUSTOMER_ACCESS_POLICY;

<?xml version="1.0" encoding="UTF-8"?>
<databaseChangeLog
        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
        xmlns:pro-snowflake="http://www.liquibase.org/xml/ns/pro-snowflake"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-latest.xsd
        http://www.liquibase.org/xml/ns/pro-snowflake
        http://www.liquibase.org/xml/ns/pro-snowflake/liquibase-pro-snowflake-latest.xsd">

    <!-- Add row access policy -->
    <changeSet id="add-row-access-policy" author="examples">
        <pro-snowflake:alterStandardTable tableName="SENSITIVE_CUSTOMER_DATA">
            <pro-snowflake:alterRowAccessPolicy
                policyName="CUSTOMER_ACCESS_POLICY"
                on="USER_ID"/>
        </pro-snowflake:alterStandardTable>
    </changeSet>

    <!-- Drop row access policy -->
    <changeSet id="drop-row-access-policy" author="examples">
        <pro-snowflake:alterStandardTable tableName="SENSITIVE_CUSTOMER_DATA">
            <pro-snowflake:alterRowAccessPolicy dropPolicy="true"/>
        </pro-snowflake:alterStandardTable>
    </changeSet>

</databaseChangeLog>

{
  "databaseChangeLog": [
    {
      "changeSet": {
        "id": "add-row-access-policy",
        "author": "examples",
        "changes": [
          {
            "alterStandardTable": {
              "tableName": "SENSITIVE_CUSTOMER_DATA",
              "alterRowAccessPolicy": {
                "policyName": "CUSTOMER_ACCESS_POLICY",
                "on": "USER_ID"
              }
            }
          }
        ]
      }
    },
    {
      "changeSet": {
        "id": "drop-row-access-policy",
        "author": "examples",
        "changes": [
          {
            "alterStandardTable": {
              "tableName": "SENSITIVE_CUSTOMER_DATA",
              "alterRowAccessPolicy": {
                "dropPolicy": true
              }
            }
          }
        ]
      }
    }
  ]
}

databaseChangeLog:
  # Add row access policy
  - changeSet:
      id: add-row-access-policy
      author: examples
      changes:
        - alterStandardTable:
            tableName: SENSITIVE_CUSTOMER_DATA
            alterRowAccessPolicy:
              policyName: CUSTOMER_ACCESS_POLICY
              on: USER_ID

  # Drop row access policy
  - changeSet:
      id: drop-row-access-policy
      author: examples
      changes:
        - alterStandardTable:
            tableName: SENSITIVE_CUSTOMER_DATA
            alterRowAccessPolicy:
              dropPolicy: true

--liquibase formatted sql

--changeset examples:add-row-access-policy
-- Add row access policy
ALTER TABLE MYDB.PUBLIC.SENSITIVE_CUSTOMER_DATA
  ADD ROW ACCESS POLICY CUSTOMER_ACCESS_POLICY ON (USER_ID);

--changeset examples:drop-row-access-policy
-- Drop row access policy
ALTER TABLE MYDB.PUBLIC.SENSITIVE_CUSTOMER_DATA
  DROP ROW ACCESS POLICY CUSTOMER_ACCESS_POLICY;

Aggregation policy

Controls privacy-preserving aggregation operations.

alterAggregationPolicy nested attributes

Attribute	Type	Description	Required
`newPolicyName`	String	Name of the aggregation policy	No*
`entityKey`	String	Entity key columns	No
`dropPolicy`	Boolean	If true, drops the policy	No*
`force`	Boolean	If true, forces the operation	No

*Specify either newPolicyName to add/modify or dropPolicy to remove.

<?xml version="1.0" encoding="UTF-8"?>
<databaseChangeLog
        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
        xmlns:pro-snowflake="http://www.liquibase.org/xml/ns/pro-snowflake"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-latest.xsd
        http://www.liquibase.org/xml/ns/pro-snowflake
        http://www.liquibase.org/xml/ns/pro-snowflake/liquibase-pro-snowflake-latest.xsd">

    <!-- Add aggregation policy -->
    <changeSet id="add-aggregation-policy" author="examples">
        <pro-snowflake:alterStandardTable tableName="ANALYTICS_DATA">
            <pro-snowflake:alterAggregationPolicy
                newPolicyName="AGGREGATION_POLICY"
                entityKey="USER_ID, TENANT_ID"/>
        </pro-snowflake:alterStandardTable>
    </changeSet>

    <!-- Drop aggregation policy -->
    <changeSet id="drop-aggregation-policy" author="examples">
        <pro-snowflake:alterStandardTable tableName="ANALYTICS_DATA">
            <pro-snowflake:alterAggregationPolicy dropPolicy="true"/>
        </pro-snowflake:alterStandardTable>
    </changeSet>

</databaseChangeLog>

{
  "databaseChangeLog": [
    {
      "changeSet": {
        "id": "add-aggregation-policy",
        "author": "examples",
        "changes": [
          {
            "alterStandardTable": {
              "tableName": "ANALYTICS_DATA",
              "alterAggregationPolicy": {
                "newPolicyName": "AGGREGATION_POLICY",
                "entityKey": "USER_ID, TENANT_ID"
              }
            }
          }
        ]
      }
    },
    {
      "changeSet": {
        "id": "drop-aggregation-policy",
        "author": "examples",
        "changes": [
          {
            "alterStandardTable": {
              "tableName": "ANALYTICS_DATA",
              "alterAggregationPolicy": {
                "dropPolicy": true
              }
            }
          }
        ]
      }
    }
  ]
}

databaseChangeLog:
  # Add aggregation policy
  - changeSet:
      id: add-aggregation-policy
      author: examples
      changes:
        - alterStandardTable:
            tableName: ANALYTICS_DATA
            alterAggregationPolicy:
              newPolicyName: AGGREGATION_POLICY
              entityKey: "USER_ID, TENANT_ID"

  # Drop aggregation policy
  - changeSet:
      id: drop-aggregation-policy
      author: examples
      changes:
        - alterStandardTable:
            tableName: ANALYTICS_DATA
            alterAggregationPolicy:
              dropPolicy: true

-- Add aggregation policy
ALTER TABLE MYDB.PUBLIC.ANALYTICS_DATA
  ADD AGGREGATION POLICY AGGREGATION_POLICY ENTITY KEY (USER_ID, TENANT_ID);

-- Drop aggregation policy
ALTER TABLE MYDB.PUBLIC.ANALYTICS_DATA
  DROP AGGREGATION POLICY AGGREGATION_POLICY;

<?xml version="1.0" encoding="UTF-8"?>
<databaseChangeLog
        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
        xmlns:pro-snowflake="http://www.liquibase.org/xml/ns/pro-snowflake"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-latest.xsd
        http://www.liquibase.org/xml/ns/pro-snowflake
        http://www.liquibase.org/xml/ns/pro-snowflake/liquibase-pro-snowflake-latest.xsd">

    <!-- Add aggregation policy -->
    <changeSet id="add-aggregation-policy" author="examples">
        <pro-snowflake:alterStandardTable tableName="ANALYTICS_DATA">
            <pro-snowflake:alterAggregationPolicy
                newPolicyName="AGGREGATION_POLICY"
                entityKey="USER_ID, TENANT_ID"/>
        </pro-snowflake:alterStandardTable>
    </changeSet>

    <!-- Drop aggregation policy -->
    <changeSet id="drop-aggregation-policy" author="examples">
        <pro-snowflake:alterStandardTable tableName="ANALYTICS_DATA">
            <pro-snowflake:alterAggregationPolicy dropPolicy="true"/>
        </pro-snowflake:alterStandardTable>
    </changeSet>

</databaseChangeLog>

{
  "databaseChangeLog": [
    {
      "changeSet": {
        "id": "add-aggregation-policy",
        "author": "examples",
        "changes": [
          {
            "alterStandardTable": {
              "tableName": "ANALYTICS_DATA",
              "alterAggregationPolicy": {
                "newPolicyName": "AGGREGATION_POLICY",
                "entityKey": "USER_ID, TENANT_ID"
              }
            }
          }
        ]
      }
    },
    {
      "changeSet": {
        "id": "drop-aggregation-policy",
        "author": "examples",
        "changes": [
          {
            "alterStandardTable": {
              "tableName": "ANALYTICS_DATA",
              "alterAggregationPolicy": {
                "dropPolicy": true
              }
            }
          }
        ]
      }
    }
  ]
}

databaseChangeLog:
  # Add aggregation policy
  - changeSet:
      id: add-aggregation-policy
      author: examples
      changes:
        - alterStandardTable:
            tableName: ANALYTICS_DATA
            alterAggregationPolicy:
              newPolicyName: AGGREGATION_POLICY
              entityKey: "USER_ID, TENANT_ID"

  # Drop aggregation policy
  - changeSet:
      id: drop-aggregation-policy
      author: examples
      changes:
        - alterStandardTable:
            tableName: ANALYTICS_DATA
            alterAggregationPolicy:
              dropPolicy: true

-- Add aggregation policy
ALTER TABLE MYDB.PUBLIC.ANALYTICS_DATA
  ADD AGGREGATION POLICY AGGREGATION_POLICY ENTITY KEY (USER_ID, TENANT_ID);

-- Drop aggregation policy
ALTER TABLE MYDB.PUBLIC.ANALYTICS_DATA
  DROP AGGREGATION POLICY AGGREGATION_POLICY;

Join policy

Controls which columns can be used in join operations.

alterJoinPolicy nested attributes

Attribute	Type	Description	Required
`newPolicyName`	String	Name of the join policy	No*
`allowedJoinKeys`	String	Columns allowed in joins	No
`dropPolicy`	Boolean	If true, drops the policy	No*
`force`	Boolean	If true, forces the operation	No

*Specify either newPolicyName to add/modify or dropPolicy to remove.

<?xml version="1.0" encoding="UTF-8"?>
<databaseChangeLog
        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
        xmlns:pro-snowflake="http://www.liquibase.org/xml/ns/pro-snowflake"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-latest.xsd
        http://www.liquibase.org/xml/ns/pro-snowflake
        http://www.liquibase.org/xml/ns/pro-snowflake/liquibase-pro-snowflake-latest.xsd">

    <!-- Add join policy -->
    <changeSet id="add-join-policy" author="examples">
        <pro-snowflake:alterStandardTable tableName="RESTRICTED_JOINS">
            <pro-snowflake:alterJoinPolicy
                newPolicyName="JOIN_POLICY"
                allowedJoinKeys="ID, USER_ID"/>
        </pro-snowflake:alterStandardTable>
    </changeSet>

    <!-- Drop join policy -->
    <changeSet id="drop-join-policy" author="examples">
        <pro-snowflake:alterStandardTable tableName="RESTRICTED_JOINS">
            <pro-snowflake:alterJoinPolicy dropPolicy="true"/>
        </pro-snowflake:alterStandardTable>
    </changeSet>

</databaseChangeLog>

{
  "databaseChangeLog": [
    {
      "changeSet": {
        "id": "add-join-policy",
        "author": "examples",
        "changes": [
          {
            "alterStandardTable": {
              "tableName": "RESTRICTED_JOINS",
              "alterJoinPolicy": {
                "newPolicyName": "JOIN_POLICY",
                "allowedJoinKeys": "ID, USER_ID"
              }
            }
          }
        ]
      }
    },
    {
      "changeSet": {
        "id": "drop-join-policy",
        "author": "examples",
        "changes": [
          {
            "alterStandardTable": {
              "tableName": "RESTRICTED_JOINS",
              "alterJoinPolicy": {
                "dropPolicy": true
              }
            }
          }
        ]
      }
    }
  ]
}

databaseChangeLog:
  # Add join policy
  - changeSet:
      id: add-join-policy
      author: examples
      changes:
        - alterStandardTable:
            tableName: RESTRICTED_JOINS
            alterJoinPolicy:
              newPolicyName: JOIN_POLICY
              allowedJoinKeys: "ID, USER_ID"

  # Drop join policy
  - changeSet:
      id: drop-join-policy
      author: examples
      changes:
        - alterStandardTable:
            tableName: RESTRICTED_JOINS
            alterJoinPolicy:
              dropPolicy: true

-- Add join policy
ALTER TABLE MYDB.PUBLIC.RESTRICTED_JOINS
  ADD JOIN POLICY JOIN_POLICY ALLOWED JOIN KEYS (ID, USER_ID);

-- Drop join policy
ALTER TABLE MYDB.PUBLIC.RESTRICTED_JOINS
  DROP JOIN POLICY JOIN_POLICY;

<?xml version="1.0" encoding="UTF-8"?>
<databaseChangeLog
        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
        xmlns:pro-snowflake="http://www.liquibase.org/xml/ns/pro-snowflake"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-latest.xsd
        http://www.liquibase.org/xml/ns/pro-snowflake
        http://www.liquibase.org/xml/ns/pro-snowflake/liquibase-pro-snowflake-latest.xsd">

    <!-- Add join policy -->
    <changeSet id="add-join-policy" author="examples">
        <pro-snowflake:alterStandardTable tableName="RESTRICTED_JOINS">
            <pro-snowflake:alterJoinPolicy
                newPolicyName="JOIN_POLICY"
                allowedJoinKeys="ID, USER_ID"/>
        </pro-snowflake:alterStandardTable>
    </changeSet>

    <!-- Drop join policy -->
    <changeSet id="drop-join-policy" author="examples">
        <pro-snowflake:alterStandardTable tableName="RESTRICTED_JOINS">
            <pro-snowflake:alterJoinPolicy dropPolicy="true"/>
        </pro-snowflake:alterStandardTable>
    </changeSet>

</databaseChangeLog>

{
  "databaseChangeLog": [
    {
      "changeSet": {
        "id": "add-join-policy",
        "author": "examples",
        "changes": [
          {
            "alterStandardTable": {
              "tableName": "RESTRICTED_JOINS",
              "alterJoinPolicy": {
                "newPolicyName": "JOIN_POLICY",
                "allowedJoinKeys": "ID, USER_ID"
              }
            }
          }
        ]
      }
    },
    {
      "changeSet": {
        "id": "drop-join-policy",
        "author": "examples",
        "changes": [
          {
            "alterStandardTable": {
              "tableName": "RESTRICTED_JOINS",
              "alterJoinPolicy": {
                "dropPolicy": true
              }
            }
          }
        ]
      }
    }
  ]
}

databaseChangeLog:
  # Add join policy
  - changeSet:
      id: add-join-policy
      author: examples
      changes:
        - alterStandardTable:
            tableName: RESTRICTED_JOINS
            alterJoinPolicy:
              newPolicyName: JOIN_POLICY
              allowedJoinKeys: "ID, USER_ID"

  # Drop join policy
  - changeSet:
      id: drop-join-policy
      author: examples
      changes:
        - alterStandardTable:
            tableName: RESTRICTED_JOINS
            alterJoinPolicy:
              dropPolicy: true

-- Add join policy
ALTER TABLE MYDB.PUBLIC.RESTRICTED_JOINS
  ADD JOIN POLICY JOIN_POLICY ALLOWED JOIN KEYS (ID, USER_ID);

-- Drop join policy
ALTER TABLE MYDB.PUBLIC.RESTRICTED_JOINS
  DROP JOIN POLICY JOIN_POLICY;