I plan to mask columns with a specific tag like "sensitive", "PII" which represents that the column values are ought to be seen by privileged user groups because they contain credentials or personal identity data.

To implement that i plan to create a function and apply to a catalog by policy.

However, I am worried on performance. did anyone try this and experience performance issue?
or is there anyone has better approach to perform the task?

Note that i have a requirement not to encrpt data.

Thank you in advance.