A Snowflake compliance demo the board can actually inspect

What this project delivers

This is the recommendation and design package for a demonstrable Snowflake capability in a legal-services context. It is deliberately scoped to be built and shown quickly, while exercising the Snowflake features that matter to a compliance audience: governed access, data protection, and auditability.

Everything here is a starting point for discussion. The board is asked to confirm scope, the data-sourcing approach, and the security posture before we build.

Four things the demo proves

Working POC and interactive demo

The board asked for a simple login experience, an examination of the CUAD sample, and Python scaffolding adaptable to Snowflake. All three are built and staged here.

Why CUAD plus synthetic records

Fabricated clause text produces a demo that feels fake and can misrepresent the strength of the platform. The Contract Understanding Atticus Dataset gives us 510 real commercial contracts with 41 expert-annotated clause categories — genuine language and genuine labels.

CUAD is public research data released under CC BY 4.0. We attach fictional matters and confidentiality labels strictly to demonstrate the mechanics. We will never present these documents as genuinely privileged, and we will carry the license attribution wherever the data appears.

Proposed architecture

A single demo database landing RAW → CORE → MARTS, with a dedicated SECURITY schema for policies and a GOV schema for the audit/reporting views.

CUAD JSON + Faker seeds
        |
        v
  RAW     raw_cuad_contracts, raw_cuad_clauses, raw_synthetic_*
        |
        v
  CORE    dim_client, dim_employee, dim_matter, dim_contract, fact_clause,
          bridge_matter_contract, matter_authorization, ref_*
        |
        v
  MARTS   mart_matter_risk, mart_high_risk_register   <-- board-facing queries
        |
  SECURITY  matter_access_policy (row access), pii masks, classification tags
  GOV       audit_summary, denied_access_log, query_history views

Ten recommendations

1. Use CUAD as the factual spine. 20–30 contracts for the demo core, with the option to scale to all 510.
2. Synthesize the business layer, not the legal text. Faker generates clients, matters, staff, assignments, and approvals.
3. Model matters as the confidentiality boundary. Every access decision keys off matter_id.
4. Enforce with row access policies on a mapping table. No matter-based filtering in application SQL.
5. Centralize policy in a SECURITY schema owned by a compliance role, applied consistently across tables.
6. Mask sensitive metadata by role (client PII, deal values) with dynamic data masking and classification tags.
7. Keep the risk rubric transparent and editable. Rules live as data in a reference table, so thresholds are reviewable — and clearly labeled simulated.
8. Prove governance through Snowflake's own logs. Query history, access history, and policy references are the evidence.
9. Ship the review site from this repo. GitHub Pages from main is the board's staging surface.
10. Keep costs near zero. X-Small warehouses with aggressive auto-suspend, and a small data footprint.

Delivery phases

1. Enablement

   Snowflake account/trial, roles, database skeleton, CI for this Pages site. Architecture →

2. Ingest & organize

   Load 20–30 CUAD contracts + annotations, generate synthetic records, validate relationships. Data foundation →

3. Enforce matter confidentiality

   Attorney/compliance roles, row access policies, masking, classification tags. Confidentiality →

4. Analyze contractual risk

   Clause-category analytics and the rule-based risk rubric. Risk analysis →

5. Verify & audit

   Multi-role access tests, query-history evidence, high-risk register. Audit →

6. Board review

   Publish this site, walk the demo, collect decisions. Roadmap →

Board decisions