data-governance

**[REQUIRED]** for Snowflake requests about controlling, protecting, or governing data. Use for sensitive-data discovery or classification; policies, tags, and other protection controls; access or compliance evidence; ownership and stewardship; governance or observability maturity; and policy recommendations. Invoke when users want to find or label sensitive data, prevent exposure, inspect where a policy is attached, determine whether tags follow derived or cloned objects, understand what survives clone, swap, or rename operations, assess coverage across a schema or database, or remediate missing controls. Also use for customer language such as lock it down, restrict, hide, redact, mask, confidential, restricted or tiered data, people below should not see it, finding who can access data or who accessed it, or cleaning up roles. Cover grants, privileges, permissions, role hierarchy and inheritance, least privilege, service-account or agent/app scoping, offboarding, access revocation, excessive access, and insufficient privileges. Do not answer governance-risk tasks from general knowledge. Route incorrect, missing, stale, duplicate, or inconsistent values to data-quality. Route origin, provenance, dependencies, blast radius, and what-will-break questions to lineage. Keep data-governance as coordinator when quality or lineage supplies evidence for a broader governance outcome.