Housing caseworkers need case status fields from a resident table but must not read Social Security numbers in that same table. Which control should the data team apply?

Column-level access control lets housing caseworkers query case status fields while blocking Social Security number columns in the same resident table. UC (and masking policies where applicable) can hide or mask sensitive attributes so frosted glass covers the SSN window while status remains visible for casework. That preserves analytic and operational utility without granting full-row PII visibility to every caseworker account.

Granting full SELECT including SSN to all caseworkers violates least privilege and expands breach impact. Deleting SSNs from production with no governed analytic substitute may break lawful downstream needs and is not required when column controls can hide values. Exporting the full resident table with SSN to unmanaged CSV for easier tools creates an ungoverned PII store outside Unity Catalog—the opposite of the control the question seeks.

Exam caveat: column control is not row-level security; if caseworkers must also be limited to their assigned cases, combine column masks with RLS. Encrypted-at-rest storage alone does not stop authorized SELECT of plaintext after decryption in query engines. Operational check: apply column deny/mask on SSN, grant caseworkers SELECT on the table, confirm status queries succeed, confirm SSN projection fails or returns masked values, and audit SHOW GRANTS / policy bindings before go-live.