PII protection
Tag sensitive columns. Use row filters and column masks so one table serves different clearances at query time. Do not put raw national IDs on a widely shared dashboard dataset.
Storage
Files sit in cloud storage via storage credentials and external locations. A raw bucket URL is not a security model. Managed tables keep files in UC-managed locations; external tables leave files when dropped.
Anti-pattern
Emailing a CSV of customers bypasses UC, lineage, and revocation. Prefer Delta Sharing, masked views, or a published dashboard with filters.