Snow Compliance DemoBoard review · v1

Plan & ownership

Roadmap, effort & demo script

A short, bounded build with explicit owners, acceptance criteria, and the narrative we will run for the board.

Schedule

Phased delivery

Approved & in progress Plan approved 2026-10-15. Snowflake is simulated for now (no account). Phases 0–2 are working in the offline POC; phases 3–4 are being deepened now; the real trial-account build is deferred until an account is approved.

  1. Enablement done (simulated)

    Database/role DDL written; the simulated engine (poc/snowflake_sim.py) stands in for the account; this review site live on main.

  2. Ingest & organize done

    CUAD loader, synthetic generator, CORE model, and data-quality assertions implemented in the POC.

  3. Confidentiality done (simulated)

    Roles, mapping, row access policy, and masking demonstrated offline; real policies on the trial later.

  4. Risk analytics done (simulated)

    Rule engine (poc/risk.py), scoring, and a risk register in the demo (High 4 / Medium 19 / Low 7).

  5. Verify & audit done (simulated)

    Role × matter verification matrix and evidence pack; offline SQL harness + CI for the DDL.

  6. Review signed off (simulated)

    Board reviewed the refreshed demo and signed off on the simulated phase 2026-10-15.

Team

Ownership

AreaOwnerResponsibility
Strategy & board coordinationCEOScope, this site, review logistics
Data pipeline & SQLPrototype (engineer)CUAD loader, Faker, CORE/MARTS, risk views
Snowflake platform & securityPlatform (devops)Account, roles, policies, audit evidence
Visual designDesignBoard-facing presentation and readability
Site buildFrontend (engineer)Interactive polish for the review site
Risk

Risks & mitigations

RiskImpactMitigation
Demo mistaken for real client dataHighProminent synthetic labeling; CUAD attribution; disclaimer on every page
Permissions overstatement (privilege)HighExplicit "public documents, fictional matters" framing
Snowflake account not provisionedMediumPhase 0 first; works on a trial account
CUAD license misuseMediumRetain CC BY 4.0 attribution and source link
Row policy gaps via joinsMediumAttach policy to every matter_id table; verify with tests
Cost creep if left runningLowX-Small + 60s auto-suspend; teardown guidance
Demo

Board demo script (~4 minutes)

  1. Frame. "Public contract data, fictional matters, simulated review criteria. What we're showing is governance, not legal advice."
  2. Show the data. A CUAD contract, its annotated clauses, and the fictional matter it belongs to.
  3. Log in as ATTORNEY_A. Run the matter query — see authorized matters. Query the other matter — zero rows. Show masked client email.
  4. Switch to ATTORNEY_B. Same query, complementary result. The wall holds at query time.
  5. Risk analytics. Show the high-risk register and the rubric behind the score.
  6. Audit. Open query history for both roles; show the policy attached via POLICY_REFERENCES.
  7. Ask. Confirm scope, data sourcing, account, and rubric framing.
Done

Definition of done

  • Site published at jpeckenpaugh.github.io/snow-compliance-demo.
  • Snowflake behaviour rebuildable from sql/ and demonstrable offline in the simulation.
  • Cross-matter access denied and demonstrated for at least two attorney roles.
  • Audit evidence captured and linked from the audit page.
  • High-risk-by-matter report produced.
  • Deferred: real row access policies / masking validated on a Snowflake trial once an account is approved.