PII / Compliance Agent

Discover, monitor, and govern sensitive data across your warehouse — without writing SQL, and without your data ever leaving your environment.

The PII agent helps compliance, data governance, and platform teams answer three questions with confidence:

• Where does PII live in my warehouse?
• Is sensitive data sitting unmasked where it shouldn't be?
• When new PII appears (or leaks) how do I know?

It runs entirely inside your warehouse using SQL-based detection, then aggregates findings alongside your existing warehouse classification tags into a single, exportable inventory view — the audit-ready map of PII posture that compliance and audit teams have always wanted, but never had a straightforward way to produce.

---

How to get started

1. Go to Agentic Operations in the left nav
2. Select PII / Compliance agent
3. Click Open and describe in plain language what you want to monitor — e.g., "Help me create a monitor to alert when unexpected PII is found in my tables"
4. The agent walks you through scope, PII types, and threshold, previews the monitor configuration, and asks you to confirm before it creates anything

Under the hood, the agent creates a Bulk PII monitor — a dedicated monitor type that scans across multiple columns and PII types in a single pass, with sampling enabled by default. This isn't something you'd replicate through the standard metric monitor UI, which requires configuring each PII type individually and doesn't support bulk sampling.

---

The PII Inventory — your single source of truth

The PII Inventory is the agent's primary output view. Find an aggregated view under Agentic Operations → PII / Compliance agent → Results tab, or in the Results tab of a specific Bulk PII monitor.

The inventory answers where does sensitive data live across our warehouse — and just as importantly, What sensitive data do I already have classified, and where?

It aggregates findings from your Bulk PII monitors alongside your existing warehouse classification tags, presenting each column with three states:

Filter by warehouse, database, or schema. Export a summary for CIO, audit, or cyber insurance reviews.

Reviewing findings

Not every detection is real PII. e.g. a numeric ID column can match the phone-number pattern. When a finding is wrong, mark it as Not PII from the inventory.

• The decision persists across future scans — the finding drops out of active results and stops triggering notifications.
• The column keeps getting scanned. This suppresses the finding, not the coverage.
• Suppressed findings stay visible in a filtered/audit view, so every review decision is traceable.
• Undo restores the finding to active if it should be treated as PII later.

---

How detection works

If your team already tags columns as PII in your warehouse, MC uses those tags as supplementary context in the inventory.

• Snowflake — reads PRIVACY_CATEGORY, SEMANTIC_CATEGORY, and SEMANTIC_SUBCATEGORY tags applied by Snowflake's native classification. Snowflake's semantic categories are often broader than a single MC type — an SSN, for example, is derived from broad values like NATIONAL_IDENTIFIER / TAX_IDENTIFIER rather than a dedicated US_SSN category.
• Databricks — reads Unity Catalog class.* tags.
• BigQuery — reads BigQuery column-level policy tags if they include PII classification.

By default, MC uses these tags to distinguish expected PII from unexpected PII in the inventory. Tags don't replace detection; they enrich it.

---

Warehouse tag integration

If your team already tags columns as PII in your warehouse, MC uses those tags as supplementary context in the inventory.

• Snowflake — reads PRIVACY_CATEGORY and SEMANTIC_CATEGORY tags applied by Snowflake's native classification, including the country-specific taxonomy (e.g., US_SSN, NZ_INLAND_REVENUE_NUMBER, AU_TAX_FILE_NUMBER).
• Databricks — reads Unity Catalog class.* tags.
• BigQuery — reads BigQuery column-level policy tags if they include PII classification.

By default, MC uses these tags to distinguish expected PII from unexpected PII in the inventory. Tags don't replace detection; they enrich it.

◆ No tagging? No problem. MC's SQL-based detection works independently. Tags are a supplementary signal, not a requirement.

---

Supported PII types

*US ZIP code and US state code are supported but noisy — they're excluded from the default, product-recommended setup and hidden from the inventory display unless you explicitly opt in.

CUSTOM REGEX

• Locate your PII monitor in the Monitors list and click "edit".
• Add custom patterns to the conditions already running.
• Regex must be compatible with your warehouse's SQL engine.
• Patterns are compiled into the underlying SQL query that runs in-warehouse. Example

---

Accessing the agent

From the Monte Carlo UI

as described above

From your IDE (developers)

The pii-monitor skill is available through the Agent Toolkit in AI coding agents like Claude Code and Cursor. The skill provides access to the find_classified_assets, create_pii_monitor, get_pii_types, get_pii_scan_inventory, and get_pii_warehouse_tag_summary MCP tools.

---

Notes

1. Masked / tokenized values. The monitor cannot identify what PII type is hidden behind masked values (****, XXXX)
2. Sampling. Bulk PII monitors sample rows by default (configurable or up to 1M rows). For very large tables, a bounded sample keeps warehouse compute predictable.
3. Result latency. After a scan runs, PII scan results can take up to an hour to appear in the inventory.
4. [July 2026] Preview status. The PII agent is currently in preview mode.