Skip to content
redactsure
Book a demo

Explore.

Comparison · By Chris Sowa · Published
Last updated

What Is the Difference Between RedactSure and Snowflake for AI Agent Data Protection?

Snowflake governs what an AI agent may query inside Snowflake, with masking policies that can withhold values from agent sessions, while RedactSure tokenizes the rendered screen of applications outside any data platform and holds each consequential action for a named person. Check whether your agents leave the warehouse, since the pages reviewed do not describe browser-based agents.

A warehouse holds databases and filtered record columns beside an independent browser workflow.

Snowflake governs what an AI agent may query inside Snowflake, with masking policies that can withhold values from agent sessions, while RedactSure tokenizes the rendered screen of applications outside any data platform and holds each consequential action for a named person. Check whether your agents leave the warehouse, since the pages reviewed do not describe browser-based agents. Snowflake protects the warehouse; RedactSure protects the screen. Snowflake's governance is agent-aware for data inside the warehouse: a masking policy can ask whether an agent is active and return a masked value even when the user's role could see the original (Snowflake, 2026). That control is precise and useful for agents whose work is analytics on governed data, and it sits at the data layer. It does not travel with an agent that leaves the warehouse to work a payer portal or a vendor payment screen, where the exposure is what the model reads on the page and the decision that matters is who approves the next action. Those sit at the render and workflow layers, where render-layer tokenization applies. The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Key findings

  • Snowflake describes Cortex Agents as "a fully managed agentic platform for building and running AI agents within Snowflake's governed environment," and Snowflake CoWork as a "ready-to-use agentic application" over enterprise data (Snowflake, 2026).
  • Snowflake's IS_AGENT_ACTIVATED function returns TRUE "if an agent is active in the current execution context," so a masking policy on a Snowflake table can withhold values from agent sessions even where the user's role could see them (Snowflake, 2026).
  • Snowflake supports external tokenization of warehouse columns through named partners, with detokenization run by a masking policy, and its AI_REDACT function replaces PII with placeholders such as [NAME] on a "best-effort" basis (Snowflake, 2026).
  • Snowflake records which agent ran a query and which policies were enforced; the pages reviewed describe no human approval of agent actions and do not address agents that work through a browser (Snowflake, 2026).
  • OWASP lists sensitive information disclosure as a top risk for LLM applications, covering personal data and confidential business data that reach or leave a model (OWASP, 2025).
  • Researchers showed that instructions planted in content an LLM application reads can redirect it, which makes anything the model can see, including a rendered web page, a possible target (Greshake et al., 2023).

What does Snowflake's documentation say it covers for AI agents?

Snowflake's agent products are three. Cortex Agents is "a fully managed agentic platform for building and running AI agents within Snowflake's governed environment," with tools that include Cortex Analyst, Cortex Search, custom procedures, web search, code execution and MCP connectors (Snowflake, 2026; vendor documentation, accessed October 16, 2026). Snowflake CoWork is a "ready-to-use agentic application" for questions over enterprise data, and it "inherits and respects" row access policies and column-level security on data held in Snowflake (Snowflake, 2026). A Snowflake-managed MCP server lets outside agents "securely retrieve data from Snowflake accounts" (Snowflake, 2026).

Governance runs through Horizon features, each applied to Snowflake objects: sensitive data classification, dynamic masking, row access policies, Access History and agent identity. Snowflake holds ISO/IEC 42001 certification (Snowflake, 2025) and, for the platform itself rather than the applications around it, FedRAMP Moderate authorization for Cortex Search, Cortex Analyst and Cortex Agents on AWS US East (Snowflake, 2025).

Outside the platform, MCP connectors reach Atlassian, GitHub, Glean, Linear, Salesforce and Google Workspace over OAuth and support "tool capabilities only." Snowflake states that external MCP servers "are not provided, maintained, or verified by Snowflake" (Snowflake, 2026).

The pages reviewed do not describe agents that operate applications through a browser, computer-use agents, or values an agent reads from a rendered web page. Every path described runs through a Snowflake object: a table and its policies, a Cortex service, the managed MCP server or a connector that calls tools. Other Snowflake documentation may cover more, and a buyer should ask.

What the pages state places Snowflake at the data layer, with controls that are agent-aware for the data the warehouse holds. The gap between the two designs is the moment an agent leaves the warehouse to work an application whose only interface is the page.

How does Snowflake's agent-aware masking work?

Classification assigns semantic and privacy categories and applies system tags; a masking policy tied to a tag is applied automatically when classification runs, on Enterprise Edition (Snowflake, 2026). Dynamic masking masks plain-text data in Snowflake tables at query time (Snowflake, 2026). For organizations that want tokens rather than masks, Snowflake integrates external tokenization partners, including Skyflow, Protegrity, Voltage and Thales, with detokenization performed by a masking policy that calls an external function (Snowflake, 2026).

The agent-specific control is the notable one. IS_AGENT_ACTIVATED lets a masking policy on a Snowflake query return a masked value when an agent is in the execution context, even where the user's role would see the original (Snowflake, 2026). This acknowledges, at the data layer, the same premise RedactSure starts from: an agent acting for a user need not see everything that user can see. Inside Snowflake, agents run with the caller's session roles, and Restricted Session Scope sets a privilege ceiling for agent sessions (Snowflake, 2026). Agents enter through Snowflake's own doors: the managed MCP server, OAuth sessions marked as agentic, or service agent users. Snowflake documents one caveat: Cortex Search queries "with owner's rights," so a role allowed to query the service can see indexed data regardless of its privileges on the underlying objects.

For unstructured text, AI_REDACT replaces PII with placeholders such as [NAME]. Snowflake calls it "best-effort," covering mainly US PII with a 4,096-token limit, and advises reviewing the output (Snowflake, 2026).

Taken together, this is a specific answer to a specific question: what a query returns when an agent asks. It is a strong answer for analytics agents. The pages reviewed tie each control to a query against Snowflake data. None of them describe a policy that follows the agent once it opens another application.

What happens to a sensitive value in each design?

Take a single record: a patient account with the patient's name, member ID and date of birth, an open claim amount and a claim number. An agent has been asked to check the claim's status in a payer portal and update the account in the billing system.

In the design Snowflake describes, the patient table sits in Snowflake. Classification tags the member ID and date of birth, and a tag-based masking policy applies. If the policy uses IS_AGENT_ACTIVATED, a Cortex Agent querying the table receives masked values even though the billing user's role could see them in clear. If the organization uses an external tokenization partner, the stored value is a partner token and detokenization runs through the masking policy. Snowflake's monitoring records which agent ran the query and which policies applied, and nothing about what happens outside the warehouse. When the agent then opens the payer portal in a browser, the portal renders the patient's identifiers in full, and the pages reviewed do not describe a control on that path.

In RedactSure's design, the agent works inside a governed environment. Before any model reads the screen, the environment replaces the name, member ID and date of birth with consistent tokens such as NAME_001, MEMBER_001 and DOB_001. The claim amount and claim number stay in clear because the status check runs on them. Consistent means MEMBER_001 on the portal and MEMBER_001 in the billing screen are the same member, so the agent can match records without the digits. The real member ID resolves only in the billing record's field, at the moment a named person approves the update. This is screen-level tokenization applied per task.

The difference matters because of what a model does with what it reads. OWASP names sensitive information disclosure as a top LLM risk (OWASP, 2025), and an instruction hidden in a portal message arrives through the screen (Greshake et al., 2023). An agent-aware mask narrows what a query returns. Tokenizing the render narrows what the model learns from each page it opens. The two controls stack.

How do the two compare side by side?

The table records what each side's documentation states. For Snowflake, that is the documentation pages listed in Sources, accessed October 16, 2026, most of them undated beyond the copyright year, and two 2025 blog posts (Snowflake, 2026). For RedactSure, it is the current published design.

Dimension Snowflake, per its documentation RedactSure, per its published design
Where protection runs In the warehouse, at query time, through masking and row access policies The rendered screen inside a governed environment, before any model reads it
Applications covered Data in Snowflake; agents built in Snowflake or entering through its managed MCP server, agentic OAuth sessions or service agent users Any application the agent works in through the browser, including ones without an API
Agent-aware masking Yes, through IS_AGENT_ACTIVATED in masking policies Tokenization applies to every model read by design
Agent identity Caller's session roles; Restricted Session Scope sets a privilege ceiling; Cortex Search queries with owner's rights Existing user permissions, unchanged; what changes is what the model sees
Treatment of a sensitive value Dynamic masks, external partner tokens, or best-effort AI_REDACT placeholders Consistent tokens per entity across every screen in the run
Restoring real values Detokenization through a masking policy that calls an external function Real values resolve only at approved destinations at the moment of an approved action
Human approval of agent actions Not described in the pages reviewed A named person approves every payment, submission and record change
Record Query and access history with agent attribution; agent traces in an event table that cannot be modified AI Control Record: every screen as tokens, every action, every approval with a name, exported to the customer's SIEM
Browser and web portal agents Not addressed in the pages reviewed; MCP connectors support "tool capabilities only" The design center

The closest overlap is the agent-aware mask. Snowflake's control and RedactSure's tokenization both withhold values from an agent that its user could see, and RedactSure does not replace that control for warehouse data. Cells that read "not described" or "not addressed" describe the pages reviewed, not the full capability of the platform, and a buyer should confirm each one with Snowflake directly or in a demonstration. The RedactSure column describes a design in pilot.

How do approval and the record differ?

Snowflake governs what an agent may read inside the warehouse and records what it read there. Agent activity appears in QUERY_HISTORY and ACCESS_HISTORY, including which agent ran a query and which policies were enforced, and agent traces are stored in an event table that cannot be modified (Snowflake, 2026). The pages reviewed, including those for Cortex Agents, the MCP server, MCP connectors and CoWork, do not describe a person approving an action an agent takes. For agents whose output is an answer, that is a reasonable design.

Agents that work operational applications produce actions: a claim payment, a submitted form, a changed record. Under Supervised Delegation, a named person grants the access, chooses the applications, confirms the tokenization policy, can watch and pause the run, and approves every consequential action before a real value resolves into the destination. The choice between screens and APIs is set out in should AI agents use screens, APIs or MCP.

The reason to hold actions outside the model is that model behavior can be redirected. OWASP describes prompt injection as a risk that can cause a model to take unintended actions (OWASP, 2025). If an injection succeeds against a RedactSure agent, it collects tokens, and the update still stops for a named person. The NIST AI Risk Management Framework separates mapping and measuring from managing risk in operation (NIST, 2023); classification and query history fit the first, and named approval inside a run fits the second.

The record follows the same split. The AI Control Record holds every screen as tokens, every action and every approval with a name, and exports to the customer's own SIEM, so the record does not become a second copy of the identifiers it describes. Snowflake's query history answers which agent read which governed data, not which action a person approved. The two records answer different audit questions, and an organization may want both.

Where does RedactSure sit?

For AI agent data protection in work that leaves the warehouse, RedactSure sits at the render and workflow layers, between the rendered application and the model. Inside a governed environment deployed into the customer's cloud, on hardware-encrypted enclaves with keys the customer holds, identifiers chosen by policy are replaced with consistent tokens before any model reads the screen. Real values resolve only at approved destinations at the moment of an approved action, and a named person approves every payment, submission and record change. The environment is model agnostic, needs no per-application integration and leaves user permissions as they are. Deployments are in pilot. Snowflake remains the data layer underneath, with agent-aware masking that RedactSure does not replace: Snowflake decides what an agent may query, and RedactSure decides what an agent sees and who signs for what it does in the applications outside the warehouse.

Everyone else controls where data can go. RedactSure controls what the AI can see.

Methodology and limitations

This page rests on Snowflake documentation for Cortex Agents, Snowflake CoWork, the managed MCP server, MCP connectors, agent monitoring, IS_AGENT_ACTIVATED, agent identity, column-level security, external tokenization, classification and AI_REDACT, accessed October 16, 2026, and on Snowflake blog posts of June 12, 2025 and October 28, 2025 (vendor documentation); the OWASP Top 10 for LLM Applications 2025 and the NIST AI Risk Management Framework (standards and guidance); preprint research on indirect prompt injection; and RedactSure's published design.

No hands-on testing of Snowflake or any other named product was performed. Where a Snowflake page does not state a capability, the table says so; "not described" means the pages reviewed, and other Snowflake documentation may describe it. Most Snowflake documentation pages are undated beyond the copyright year. Snowflake Intelligence documentation now redirects to Snowflake CoWork, and this page uses the current name. Vendor features change, and the page carries its date. RedactSure statements describe the current design, with deployments in pilot. The patient account is an example of a record type; no specific organization is described.

Whether either product, or both together, meets an organization's obligations is a determination for its counsel, its assessors, and its own security and compliance officers. A buyer should confirm each "not stated" cell directly with Snowflake and request a demonstration of RedactSure's tokenized screen on the buyer's own task before relying on any row of the comparison.

What the record shows

Snowflake has built an agent-aware governance model for data inside its platform: masking that knows when an agent is active, a privilege ceiling for agent sessions, and query history that names the agent. The pages reviewed extend none of it to screens outside Snowflake. The agent that opens a third-party application in a browser reads whatever that page renders, and the pages reviewed describe no warehouse policy on that path. The test is to name one agent and one task and ask each vendor to show what the model receives on the first screen and who approves the step that changes the record.

Frequently asked questions

Can Snowflake mask data from AI agents specifically?

Yes. A masking policy can use IS_AGENT_ACTIVATED to return a masked value when an agent is active in the execution context, even if the user's role could see the original. Restricted Session Scope adds a privilege ceiling for agent sessions. The pages reviewed tie these controls to queries against Snowflake data, not to screens in other applications.

Does Snowflake protect what an agent sees in other applications?

The pages reviewed do not describe browser or web portal agents. Snowflake reaches outside services through MCP connectors over OAuth, which support "tool capabilities only," and it states that external MCP servers are not provided, maintained or verified by Snowflake. A buyer with browser-based agents should ask Snowflake directly how that path is covered.

Does Snowflake tokenize data?

Through external partners such as Skyflow, Protegrity, Voltage and Thales, with detokenization performed by a masking policy that calls an external function. AI_REDACT replaces PII in text with placeholders such as [NAME] on a best-effort basis. RedactSure's tokens are consistent per entity across every screen in a run and resolve only at approved destinations.

Does Snowflake require human approval for agent actions?

The pages reviewed, including those for Cortex Agents, the managed MCP server, MCP connectors and CoWork, do not describe a person approving an action an agent takes. RedactSure requires a named person to approve every payment, submission and record change, and records each approval with a name in the AI Control Record.

What does Snowflake record about agent activity?

Query and access history name the agent and the policies enforced, and agent traces are stored in an event table that cannot be modified. RedactSure's AI Control Record holds every screen as tokens, every action and every approval with a name, and exports to the customer's SIEM. The first answers what an agent queried; the second answers what it saw and did.

Can an organization use Snowflake and RedactSure together?

Yes, the designs protect different layers. Snowflake governs warehouse data and the agents that query it, including agent-aware masking. RedactSure governs agents that work applications through the browser, tokenizing each screen and holding each consequential action for a named person. Snowflake's classification can also inform which fields a RedactSure policy tokenizes.

Book an AI Agent Security Review →

Bring your hardest questions.

Bring one sensitive workflow and the decisions your team needs to keep in its hands.

Book a demo

About the author

Christopher Sowa
Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

Book a demo

Book a demo

Having trouble? Open the booking page or email us.