addRowAccessPolicyOnView

Last updated: January 27, 2026

Adds a row access policy to a view in Snowflake. The policy arguments must map to specific view columns to filter row-level access based on the policy expression.

Note: Automatic rollback drops the policy from the view.

Known limitation: This change type does not support database inspection features (snapshot, diff, diff-changelog, and generate-changelog commands).

Available attributes

Attribute	Type	Description	Required
`viewCatalogName`	String	Name of the catalog (database) containing the view	No
`viewSchemaName`	String	Name of the schema containing the view	No
`viewName`	String	Name of the view to apply the policy to	Yes
`policyCatalogName`	String	Name of the catalog containing the policy (cross-schema)	No
`policySchemaName`	String	Name of the schema containing the policy (cross-schema)	No
`policyName`	String	Name of the row access policy to apply	Yes
`ifExists`	Boolean	Apply policy only if view exists using `IF EXISTS`	No
`rowAccessPolicyColumns`	Nested	Wrapper for columns that map to policy arguments	Yes

column attributes (nested in rowAccessPolicyColumns)

Attribute	Type	Description	Required
`columnName`	String	Name of the view column to map to policy	Yes

<?xml version="1.0" encoding="UTF-8"?>
<databaseChangeLog
        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
        xmlns:pro-snowflake="http://www.liquibase.org/xml/ns/pro-snowflake"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-latest.xsd
        http://www.liquibase.org/xml/ns/pro-snowflake
        http://www.liquibase.org/xml/ns/pro-snowflake/liquibase-pro-snowflake-latest.xsd">

    <!-- Add policy to view -->
    <changeSet id="add-policy-on-view" author="examples">
        <pro-snowflake:addRowAccessPolicyOnView
                viewName="EMPLOYEE_SUMMARY_VIEW"
                policyName="DEPARTMENT_ACCESS_POLICY">
            <pro-snowflake:rowAccessPolicyColumns>
                <pro-snowflake:column columnName="department_id"/>
                <pro-snowflake:column columnName="access_level"/>
            </pro-snowflake:rowAccessPolicyColumns>
        </pro-snowflake:addRowAccessPolicyOnView>
    </changeSet>

    <!-- Add policy with IF EXISTS -->
    <changeSet id="add-policy-on-view-if-exists" author="examples">
        <pro-snowflake:addRowAccessPolicyOnView
                viewName="SALES_REPORT_VIEW"
                policyName="TENANT_ISOLATION_POLICY"
                ifExists="true">
            <pro-snowflake:rowAccessPolicyColumns>
                <pro-snowflake:column columnName="tenant_id"/>
            </pro-snowflake:rowAccessPolicyColumns>
        </pro-snowflake:addRowAccessPolicyOnView>
    </changeSet>

    <!-- Add cross-schema policy -->
    <changeSet id="add-policy-cross-schema" author="examples">
        <pro-snowflake:addRowAccessPolicyOnView
                viewName="FINANCE_DASHBOARD_VIEW"
                policySchemaName="SECURITY"
                policyName="FINANCE_ACCESS_POLICY">
            <pro-snowflake:rowAccessPolicyColumns>
                <pro-snowflake:column columnName="user_id"/>
            </pro-snowflake:rowAccessPolicyColumns>
        </pro-snowflake:addRowAccessPolicyOnView>
    </changeSet>

</databaseChangeLog>

{
  "databaseChangeLog": [
    {
      "changeSet": {
        "id": "add-policy-on-view",
        "author": "examples",
        "changes": [
          {
            "addRowAccessPolicyOnView": {
              "viewName": "EMPLOYEE_SUMMARY_VIEW",
              "policyName": "DEPARTMENT_ACCESS_POLICY",
              "rowAccessPolicyColumns": [
                { "column": { "columnName": "department_id" } },
                { "column": { "columnName": "access_level" } }
              ]
            }
          }
        ]
      }
    },
    {
      "changeSet": {
        "id": "add-policy-on-view-if-exists",
        "author": "examples",
        "changes": [
          {
            "addRowAccessPolicyOnView": {
              "viewName": "SALES_REPORT_VIEW",
              "policyName": "TENANT_ISOLATION_POLICY",
              "ifExists": true,
              "rowAccessPolicyColumns": [
                { "column": { "columnName": "tenant_id" } }
              ]
            }
          }
        ]
      }
    },
    {
      "changeSet": {
        "id": "add-policy-cross-schema",
        "author": "examples",
        "changes": [
          {
            "addRowAccessPolicyOnView": {
              "viewName": "FINANCE_DASHBOARD_VIEW",
              "policySchemaName": "SECURITY",
              "policyName": "FINANCE_ACCESS_POLICY",
              "rowAccessPolicyColumns": [
                { "column": { "columnName": "user_id" } }
              ]
            }
          }
        ]
      }
    }
  ]
}

databaseChangeLog:
  # Add policy to view
  - changeSet:
      id: add-policy-on-view
      author: examples
      changes:
        - addRowAccessPolicyOnView:
            viewName: EMPLOYEE_SUMMARY_VIEW
            policyName: DEPARTMENT_ACCESS_POLICY
            rowAccessPolicyColumns:
              - column:
                  columnName: department_id
              - column:
                  columnName: access_level

  # Add policy with IF EXISTS
  - changeSet:
      id: add-policy-on-view-if-exists
      author: examples
      changes:
        - addRowAccessPolicyOnView:
            viewName: SALES_REPORT_VIEW
            policyName: TENANT_ISOLATION_POLICY
            ifExists: true
            rowAccessPolicyColumns:
              - column:
                  columnName: tenant_id

  # Add cross-schema policy
  - changeSet:
      id: add-policy-cross-schema
      author: examples
      changes:
        - addRowAccessPolicyOnView:
            viewName: FINANCE_DASHBOARD_VIEW
            policySchemaName: SECURITY
            policyName: FINANCE_ACCESS_POLICY
            rowAccessPolicyColumns:
              - column:
                  columnName: user_id

--liquibase formatted sql

--changeset examples:add-policy-to-view
-- Add policy to view
ALTER VIEW PUBLIC.EMPLOYEE_SUMMARY_VIEW ADD ROW ACCESS POLICY PUBLIC.DEPARTMENT_ACCESS_POLICY ON (department_id, access_level);

--changeset examples:add-policy-with-if-exists
-- Add policy with IF EXISTS
ALTER VIEW IF EXISTS PUBLIC.SALES_REPORT_VIEW ADD ROW ACCESS POLICY PUBLIC.TENANT_ISOLATION_POLICY ON (tenant_id);

--changeset examples:add-cross-schema-policy
-- Add cross-schema policy
ALTER VIEW PUBLIC.FINANCE_DASHBOARD_VIEW ADD ROW ACCESS POLICY SECURITY.FINANCE_ACCESS_POLICY ON (user_id);

<?xml version="1.0" encoding="UTF-8"?>
<databaseChangeLog
        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
        xmlns:pro-snowflake="http://www.liquibase.org/xml/ns/pro-snowflake"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-latest.xsd
        http://www.liquibase.org/xml/ns/pro-snowflake
        http://www.liquibase.org/xml/ns/pro-snowflake/liquibase-pro-snowflake-latest.xsd">

    <!-- Add policy to view -->
    <changeSet id="add-policy-on-view" author="examples">
        <pro-snowflake:addRowAccessPolicyOnView
                viewName="EMPLOYEE_SUMMARY_VIEW"
                policyName="DEPARTMENT_ACCESS_POLICY">
            <pro-snowflake:rowAccessPolicyColumns>
                <pro-snowflake:column columnName="department_id"/>
                <pro-snowflake:column columnName="access_level"/>
            </pro-snowflake:rowAccessPolicyColumns>
        </pro-snowflake:addRowAccessPolicyOnView>
    </changeSet>

    <!-- Add policy with IF EXISTS -->
    <changeSet id="add-policy-on-view-if-exists" author="examples">
        <pro-snowflake:addRowAccessPolicyOnView
                viewName="SALES_REPORT_VIEW"
                policyName="TENANT_ISOLATION_POLICY"
                ifExists="true">
            <pro-snowflake:rowAccessPolicyColumns>
                <pro-snowflake:column columnName="tenant_id"/>
            </pro-snowflake:rowAccessPolicyColumns>
        </pro-snowflake:addRowAccessPolicyOnView>
    </changeSet>

    <!-- Add cross-schema policy -->
    <changeSet id="add-policy-cross-schema" author="examples">
        <pro-snowflake:addRowAccessPolicyOnView
                viewName="FINANCE_DASHBOARD_VIEW"
                policySchemaName="SECURITY"
                policyName="FINANCE_ACCESS_POLICY">
            <pro-snowflake:rowAccessPolicyColumns>
                <pro-snowflake:column columnName="user_id"/>
            </pro-snowflake:rowAccessPolicyColumns>
        </pro-snowflake:addRowAccessPolicyOnView>
    </changeSet>

</databaseChangeLog>

{
  "databaseChangeLog": [
    {
      "changeSet": {
        "id": "add-policy-on-view",
        "author": "examples",
        "changes": [
          {
            "addRowAccessPolicyOnView": {
              "viewName": "EMPLOYEE_SUMMARY_VIEW",
              "policyName": "DEPARTMENT_ACCESS_POLICY",
              "rowAccessPolicyColumns": [
                { "column": { "columnName": "department_id" } },
                { "column": { "columnName": "access_level" } }
              ]
            }
          }
        ]
      }
    },
    {
      "changeSet": {
        "id": "add-policy-on-view-if-exists",
        "author": "examples",
        "changes": [
          {
            "addRowAccessPolicyOnView": {
              "viewName": "SALES_REPORT_VIEW",
              "policyName": "TENANT_ISOLATION_POLICY",
              "ifExists": true,
              "rowAccessPolicyColumns": [
                { "column": { "columnName": "tenant_id" } }
              ]
            }
          }
        ]
      }
    },
    {
      "changeSet": {
        "id": "add-policy-cross-schema",
        "author": "examples",
        "changes": [
          {
            "addRowAccessPolicyOnView": {
              "viewName": "FINANCE_DASHBOARD_VIEW",
              "policySchemaName": "SECURITY",
              "policyName": "FINANCE_ACCESS_POLICY",
              "rowAccessPolicyColumns": [
                { "column": { "columnName": "user_id" } }
              ]
            }
          }
        ]
      }
    }
  ]
}

databaseChangeLog:
  # Add policy to view
  - changeSet:
      id: add-policy-on-view
      author: examples
      changes:
        - addRowAccessPolicyOnView:
            viewName: EMPLOYEE_SUMMARY_VIEW
            policyName: DEPARTMENT_ACCESS_POLICY
            rowAccessPolicyColumns:
              - column:
                  columnName: department_id
              - column:
                  columnName: access_level

  # Add policy with IF EXISTS
  - changeSet:
      id: add-policy-on-view-if-exists
      author: examples
      changes:
        - addRowAccessPolicyOnView:
            viewName: SALES_REPORT_VIEW
            policyName: TENANT_ISOLATION_POLICY
            ifExists: true
            rowAccessPolicyColumns:
              - column:
                  columnName: tenant_id

  # Add cross-schema policy
  - changeSet:
      id: add-policy-cross-schema
      author: examples
      changes:
        - addRowAccessPolicyOnView:
            viewName: FINANCE_DASHBOARD_VIEW
            policySchemaName: SECURITY
            policyName: FINANCE_ACCESS_POLICY
            rowAccessPolicyColumns:
              - column:
                  columnName: user_id

--liquibase formatted sql

--changeset examples:add-policy-to-view
-- Add policy to view
ALTER VIEW PUBLIC.EMPLOYEE_SUMMARY_VIEW ADD ROW ACCESS POLICY PUBLIC.DEPARTMENT_ACCESS_POLICY ON (department_id, access_level);

--changeset examples:add-policy-with-if-exists
-- Add policy with IF EXISTS
ALTER VIEW IF EXISTS PUBLIC.SALES_REPORT_VIEW ADD ROW ACCESS POLICY PUBLIC.TENANT_ISOLATION_POLICY ON (tenant_id);

--changeset examples:add-cross-schema-policy
-- Add cross-schema policy
ALTER VIEW PUBLIC.FINANCE_DASHBOARD_VIEW ADD ROW ACCESS POLICY SECURITY.FINANCE_ACCESS_POLICY ON (user_id);

addRowAccessPolicyOnView

Available attributes

column attributes (nested in rowAccessPolicyColumns)

XML

JSON

YAML

SQL

More like this