Log who ran which query against which objects, every grant and policy change, every login and every export, then alert on unusual volume, new access paths and edits to protection policies. Keep the logs in a separate place from the warehouse admins, and keep row values out of them.
Events worth capturing
- Authentication: logins, failures, source network, method.
- Queries: user or service identity, time, objects touched, rows returned or bytes scanned.
- Grants and role changes: who gave what to whom.
- Policy changes: creation, alteration and removal of masking and row policies.
- Exports and unloads: copies to storage or external tools.
- Admin actions: new service accounts, changed network rules, new integrations.
Platforms differ in what they expose and for how long, so read your platform's documentation and test that the events you expect actually arrive. For instance, BigQuery logs policy creation and deletion but omits filter definitions, so keep policy code in version control. Snowflake exposes policy usage through its Account Usage views, which helps you list protected columns.
Alerts that earn their keep
- A service account reading far more rows than its normal pattern.
- A human account querying a raw layer it rarely touches.
- A policy dropped or replaced outside a deployment window.
- A large export to a new destination.
- A grant to a broad role, or to PUBLIC.
- Credentials used from a new network.
Start with a few alerts you will actually investigate. A noisy rule that nobody reads protects nothing.
Establish baselines
Alerts on volume need a baseline per identity. Collect a few weeks of normal behavior, then set thresholds. Revisit after reorganizations and new projects.
Protect the logs
Send logs to a store that warehouse admins cannot edit. Restrict who can read them, since queries can contain literal values. Set retention to match your obligations, and test that you can search quickly.
Keep sensitive values out
Queries may embed names or IDs in filter clauses. Decide whether to store full text, or hash literals, and who may view the raw version. Do not copy result rows into logs.
Review as a routine
Weekly: a short look at alerts and new grants. Quarterly: access reviews comparing roles with job functions. Keep a record. See warehouse role design for the structure these reviews check.
Try it yourself
The continuous monitoring demo shows how ongoing checks surface changes as they happen. Click through and notice how a finding moves from detection to follow up.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard offers compliance and evidence automation, which can store the records of your reviews, and asset discovery. Free scan: https://gold.safeguard.sh/scan.
Quick check
Why store warehouse logs outside the warehouse admins' reach?
An admin who can edit logs can hide their own actions, so use a separate store with restricted write access.
What is the first alert to set up?
Removal or replacement of masking and row policies outside a planned deployment, because it silently removes protection.
Sources
Last reviewed: 19 October 2026.
