Masking function with GRANT per column

Column masking has been great help in managing sensitive data and complying with the General Data Protection Regulation (GDPR).
But today’s solution to know if a user has access to data without masking is to create a Mask using a CASE with SESSION_USER or VERIFY_GROUP_FOR_USER.
But when you have a Mask defined, you have many restrictions to select the data, receiving SQLCODE -20478, even if the user has authority to access the data.

This is a sample of the test we did to get the error:

- Table with column mask:
CREATE TABLE DB2TST.USER (
  ID_USER INT NOT NULL
    GENERATED BY DEFAULT AS IDENTITY,
  ST_NAME VARCHAR(20) NOT NULL,
  ST_EMAIL VARCHAR(20) NOT NULL,
  DT_BIRTHDAY DATE NOT NULL
);
CREATE MASK DB2TST.EMAIL_MASK ON DB2TST.USER
  FOR COLUMN ST_EMAIL RETURN
    CASE
      WHEN (VERIFY_GROUP_FOR_USER(SESSION_USER,'GRPDBA') = 1)
        THEN ST_EMAIL
      ELSE 'xxxx@xxxxxxx.xxx'
     END
   ENABLE;

- Query (SELECT *) from USER1 member of group GRPDBA:
  SELECT * FROM DB2TST.USER;
---------+---------+---------+---------+---------+---------+---------
    ID_USER  ST_NAME               ST_EMAIL              DT_BIRTHDAY
---------+---------+---------+---------+---------+---------+---------
          1  maria                 maria@email.com       14.05.1982
          2  joao                  joao@email.com        14.05.1982
          3  ana                   ana@email.com         14.05.1982
          4  jose                  jose@email.com        14.05.1982

- Query (SELECT CASE) from USER1 member of group GRPDBA:
  SELECT
    CASE
      WHEN ST_EMAIL LIKE 'MARIA%' THEN 'OK'
      ELSE 'NOT OK'
     END
  FROM DB2TST.USER;
---------+---------+---------+---------+---------+---------+---------
DSNT408I SQLCODE = -20478, ERROR:  THE STATEMENT CANNOT BE PROCESSED BECAUSE
         COLUMN MASK DB2TST.EMAIL_MASK (DEFINED FOR COLUMN USER.ST_EMAIL)
         EXISTS          AND THE COLUMN MASK CANNOT BE APPLIED OR THE
         DEFINITION OF THE MASK CONFLICTS WITH THE REQUESTED STATEMENT. REASON CODE 24

This is a big problem to us, as we have a Data Warehousing Datasharing Group, where many analysts can access the data, using many functions that are restricts because the Masking.
We need an implementation to solve this problem. We would like that if the user has authority to access the data, he can use any option available to do a Select. With GRANT he can SELECT anything, and the MASK function is not started, so no restrictions exists.