The following examples show how to use the INVOKER_ROLE in a masking policy SQL expression. Return NULL for unauthorized users: CREATE OR REPLACE MASKING POLICY mask_string AS (val string) RETURNS string -> CASE WHEN INVOKER_ROLE() IN ('ANALYST') THEN val ELSE NULL END;

A: The CURRENT_ROLE() context function returns the role currently active for the session. Masking policies can be configured to apply based on the current role, allowing different views of data based on the user's role. C: The INVOKER_ROLE() context function returns the role that invoked the function or SQL statement. This allows masking policies to dynamically apply based on the role executing the query, ensuring data security based on the user's permissions.

Which you then use to determine whether the column is visible in a data masking arrangement. Why can't B be used?

Changing to A & C. Although C isn't recommended, it is the more accurate description. For B the documentation states: Verifies whether the account role is in the user’s active primary or secondary role hierarchy for the session or if the specified column contains a role that is in the user’s active primary or secondary role hierarchy for the session.

A & B are correct answers