DGCC User Guide

The Tulapi.ai Data Governance Command Center provides a centralized governance layer for Snowflake, helping data, security, governance, and platform teams understand and manage their Snowflake environment from one place.

Instead of navigating multiple Snowflake administration screens and manually correlating users, roles, privileges, policies, classifications, tags, lineage, quality, sharing, and security information, the Command Center brings these governance capabilities together into a unified experience.

The platform helps organizations

• Understand their Snowflake data estate.
• Identify governance gaps and security risks.
• Review users, roles, privileges, and effective access.
• Protect sensitive information.
• Discover and classify sensitive data.
• Standardize metadata and tagging.
• Establish ownership and stewardship.
• Trace upstream and downstream lineage.
• Monitor data quality.
• Detect security and governance risks.
• Govern external data sharing.
• Monitor AI and Cortex usage.
• Take remediation actions directly from governance findings.
• Maintain evidence for governance and compliance reviews.

After opening the Data Governance Command Center, connect or select the Snowflake environment that you want to govern.

The application retrieves authorized governance metadata from Snowflake and organizes it into the following major areas:

• Overview
• Access Control
• Data Protection
• Data Classification
• Object Tagging
• Data Stewardship
• Data Lineage
• Data Quality
• Trust / Risk Center
• Network & Authentication Security
• Secure Data Sharing
• AI Governance

The Overview is the recommended starting point. It provides a consolidated picture of the current governance posture before administrators move into individual governance modules.

Purpose

The Overview provides an executive and operational view of the Snowflake governance environment. Use this page to quickly answer:

How well governed is our Snowflake environment, and what requires attention?

Key information displayed

Typical indicators include:

• Governance Score
• Critical Risks
• Governance Gaps
• Sensitive Data Exposure
• Risky Access
• Users
• Roles
• Databases
• Schemas
• Tables
• Sensitive Objects
• Policy Coverage
• Ownership Coverage
• Data Quality Signals

How to use it

Start by reviewing the high-level governance KPIs. Then examine:

Recommended workflow

Purpose

Access Control helps administrators understand:

Who has access to Snowflake, what can they access, and how did they receive that access?

Use Access Control to manage and review Snowflake:

• Users
• Roles
• Role hierarchy
• Role assignments
• Object privileges
• Future grants
• Effective access
• Privileged access
• Access reviews

Users

View Snowflake users and information such as:

• Username
• Status
• Default Role
• Assigned Roles
• Last Login
• Authentication Information
• Access Risk

Typical actions include:

• Create User
• Activate / Deactivate User
• Assign Role
• Revoke Role
• Review Access
• Delete User

Roles

Use the Roles section to understand:

• Role hierarchy
• Child roles
• Parent roles
• Users assigned
• Objects accessible
• Privileges granted

Administrators can identify roles with excessive privileges such as:

• ACCOUNTADMIN
• SECURITYADMIN
• SYSADMIN
• OWNERSHIP
• ALL PRIVILEGES

Effective Access

Effective Access explains why a user can access an object. For example:

This is particularly useful when access has been inherited through several role levels.

Recommended use

Use this module regularly for:

• Least-privilege reviews
• Dormant-user reviews
• Privileged-role reviews
• Sensitive-data access reviews
• Role cleanup
• Access certification

Purpose

Data Protection controls how sensitive information can be viewed or used. Use this area to manage Snowflake protection mechanisms such as:

• Masking Policies
• Row Access Policies
• Projection Policies
• Aggregation Policies
• Join Policies
• Secure Views

Masking Policies

Mask sensitive column values based on role or context. Example:

Use masking for:

• Email
• Phone
• National ID
• Credit card number
• Customer information
• Salary
• Financial information

Typical workflow:

Row Access Policies

Restrict which rows users can see. Example:

Use Row Access Policies when data visibility depends on:

• Region
• Department
• Business Unit
• Legal Entity
• Country
• Role

Projection Policies

Control whether a sensitive column can be included in query output. This is useful when some users may query a table but should not be able to project particular sensitive columns.

Aggregation Policies

Restrict access so data can only be returned at an approved aggregate level. Useful for privacy-sensitive analytical datasets.

Join Policies

Control which columns or objects can participate in joins. Use this to prevent inappropriate linkage of sensitive datasets.

Secure Views

Create governed views exposing only approved:

• Columns
• Rows
• Transformations
• Business logic

while protecting underlying table implementation details.

Purpose

Data Classification helps identify sensitive information inside Snowflake. Use it to answer:

Where is sensitive data stored?

Examples include:

• Name
• Email
• Phone
• Address
• National identifiers
• Financial data
• Payment information
• Health information
• Credentials

How to use

Select the database, schema, or table you want to classify. Run or review classification. The Command Center can then display:

• Object
• Column
• Detected Category
• Sensitivity
• Classification
• Recommended Action

Example:

From here, administrators can navigate directly to Data Protection.

Purpose

Tags allow organizations to add standardized governance metadata to Snowflake objects. Examples:

• SENSITIVITY = RESTRICTED
• DOMAIN = FINANCE
• ENVIRONMENT = PRODUCTION
• CRITICALITY = HIGH
• DATA_OWNER = FINANCE
• CERTIFICATION = CERTIFIED

What can be tagged

Depending on Snowflake object support, the Command Center can help manage tags across objects including:

• Databases
• Schemas
• Tables
• Views
• Columns
• Other supported Snowflake objects

Typical actions

• Create Tag
• Define Allowed Values
• Apply Tag
• Change Tag Value
• Remove Tag
• Review Tag References

Tagging should be used together with classification and protection. Example:

Purpose

Data Stewardship establishes accountability for governed data. Use it to answer:

Who is responsible for this data?

Typical stewardship roles include:

• Data Owner
• Data Steward
• Support Contact
• Approver
• Security & Compliance Contact

Example:

Stewardship coverage

Use this page to identify:

• Objects without owners
• Objects without stewards
• Sensitive data without accountability
• Critical datasets without support contacts
• Domains with stewardship gaps

A governance finding could look like:

Purpose

Data Lineage helps users understand:

Where did this data come from, and where is it being used?

The Command Center can provide:

• Upstream Lineage
• Downstream Lineage
• Column Lineage
• Multi-Hop Lineage
• Impact Analysis

Example:

Upstream lineage

Use this when you need to understand the source of a table or column.

Downstream lineage

Use this before changing or deleting an object. Example:

Column lineage

Trace individual columns:

Impact analysis

Before modifying:

• Table
• View
• Column
• Procedure
• Pipeline

review downstream dependencies. This helps prevent breaking business reports and analytical workloads.

Purpose

Data Quality helps identify whether important Snowflake datasets remain trustworthy and usable. Typical checks include:

• Null Checks
• Freshness
• Duplicate Checks
• Uniqueness
• Row Count
• Custom Data Quality Rules

Example:

Another:

Recommended workflow

Quality information should be connected with stewardship and lineage so teams can understand both who should fix the issue and what the issue affects.

Purpose

The Risk Center consolidates governance and security findings from across the Snowflake account. Use it as the central location for:

• Violations
• Detections
• Sensitive Data Risks
• Security Findings
• Governance Gaps
• AI Risks
• Assigned Contacts

Example:

Administrators should use this page to prioritize remediation rather than manually checking every governance module.

Purpose

This module helps govern how users and applications connect to Snowflake. Areas can include:

• Network Rules
• Network Policies
• Authentication Policies
• MFA
• Password Policies
• Session Policies
• OAuth
• Security Integrations

Use the module to detect situations such as:

• Broad network access
• Weak authentication configuration
• Missing MFA controls
• Long-running sessions
• Incorrect network-policy assignments
• Authentication-policy gaps

Changes to network and authentication controls should always be reviewed carefully because they can affect user connectivity.

Purpose

Secure Sharing governs data leaving the organization's Snowflake environment. Use this area to understand:

• Shares
• Consumers
• Shared Databases
• Shared Schemas
• Shared Tables
• Shared Views
• Sensitive Shared Data

Typical actions include:

• Create Share
• Add Object
• Remove Object
• Add Consumer
• Remove Consumer
• Review Share
• Drop Share
• Create Secure View

Before sharing sensitive information, administrators should review:

• Classification
• Sensitivity
• Protection
• Owner
• Steward
• Recipient
• Business Purpose

Example:

Recommended action:

Use a protected/secure view rather than exposing the raw table.

Purpose

AI Governance helps organizations understand and control Snowflake AI/Cortex usage. Use the module to review:

• AI-enabled roles
• Cortex privileges
• AI functions
• AI usage
• AI-related security findings
• AI asset tags
• AI governance posture

Typical questions include:

• Who can use AI functionality?
• Which roles have broad Cortex privileges?
• Are sensitive datasets being used by AI?
• Which AI assets have been approved?
• Are AI usage controls aligned with organizational governance policies?

Example finding:

AI Governance should work together with:

• Access Control
• Classification
• Data Protection
• Lineage
• Risk Center

A good way to explain the product is through one connected scenario. Suppose Snowflake contains:

Step 1 — Discover

The customer appears in the Governance Overview.

Step 2 — Classify

Classification detects:

Step 3 — Tag

Tulapi applies or recommends:

• DOMAIN = CUSTOMER
• SENSITIVITY = RESTRICTED
• CRITICALITY = HIGH

Step 4 — Assign responsibility

Step 5 — Protect

Step 6 — Review access

Tulapi identifies:

• 82 users can query CUSTOMER
• 17 receive unmasked PII
• 3 have unnecessary direct access

Administrators review or revoke excessive access.

Step 7 — Review lineage

Step 8 — Monitor quality

Tulapi finds:

The issue is routed to the appropriate owner.

Step 9 — Review sharing

Tulapi detects that customer information is included in an external share. Administrators verify whether:

• PII is required
• Protection is sufficient
• Recipient is approved
• Business purpose is valid

Step 10 — Continuous governance

The Risk Center continuously brings together findings from:

• Access
• Protection
• Classification
• Stewardship
• Quality
• Lineage
• Sharing
• Security
• AI

so administrators have one prioritized governance view.

A governance administrator can use the Command Center in this order:

Different teams can use the same platform for different responsibilities.

The value is not simply displaying Snowflake metadata. The Command Center connects governance information together.

Instead of seeing:

the user should be able to understand:

That is the main operating concept of the platform: discover governance context, understand risk, take action, and verify the result from one centralized governance experience.