ADA-C01 Question 132
Single answerManage access to AI features and modelsA Snowflake administrator is enabling Cortex AI capabilities for a data science team. The company has strict governance requirements: only members of the DS_ROLE role should be able to invoke AI functions, and they should be limited to approved models only. Other analysts in the same database must continue to query tables but must not be able to use Cortex model inference. Which action should the administrator take to meet these requirements with least privilege?
- A
Grant the SNOWFLAKE.CORTEX_USER database role to DS_ROLE, and configure an allowlist of approved models for that role.
- B
Grant USAGE on the database and schema containing the data to DS_ROLE, and revoke SELECT on sensitive tables from all other roles.
- C
Grant ACCOUNTADMIN to the data science lead temporarily so they can enable Cortex functions and choose approved models for their team.
- D
Create a masking policy on prompt columns so only DS_ROLE can submit text to Cortex functions.
Show answer and explanation
Correct answer: A
Explanation
The key administrative concept is separating data access from AI feature access. In Snowflake, use of Cortex inference capabilities is controlled through the SNOWFLAKE.CORTEX_USER database role. Granting that role only to DS_ROLE ensures only the intended team can use Cortex functions. To further restrict usage to approved models, administrators should apply the relevant model governance controls such as allowlisting or restricting model access according to current Snowflake-supported controls. This approach follows least privilege and avoids conflating object privileges like SELECT or governance tools like masking policies with entitlement to AI functionality. Candidates should recognize that secure administration of AI features requires granting the specific AI access role and restricting model availability, rather than broad admin access or unrelated object-level controls.
- A. Correct.
Correct. Access to Snowflake Cortex AI inference capabilities is controlled through the SNOWFLAKE.CORTEX_USER database role. Granting that database role to DS_ROLE enables use of Cortex functions for that role, while users without it can still access tables if they have the normal object privileges but cannot invoke Cortex inference. To satisfy the governance requirement around approved models, the administrator should use model access controls or allowlisting so DS_ROLE can use only the organization's approved models. This aligns with least-privilege administration for AI feature access.
- B. Incorrect.
Incorrect. Database and schema USAGE, along with table privileges such as SELECT, govern access to data objects, not access to Cortex AI inference features. A user can have normal table access without being allowed to call Cortex functions. Revoking SELECT from other roles would unnecessarily restrict data access and still would not correctly implement AI feature governance.
- C. Incorrect.
Incorrect. Granting ACCOUNTADMIN is excessive and violates least-privilege principles. Administrative roles should not be used to let end users consume AI features. Cortex access is intended to be delegated through the appropriate Snowflake-provided database role and model governance controls, not through powerful account-level administration privileges.
- D. Incorrect.
Incorrect. Masking policies protect sensitive data presentation, but they do not control whether a role is permitted to invoke Cortex functions or which models a role may access. Someone might choose this option because prompt governance is important, but masking is a data protection mechanism, not the primary access control for AI feature entitlement.