ADA-C01 Question 162
Single answerEnable Cortex AI features for usersA Snowflake administrator is rolling out Cortex AI features to a team of analysts who will use AI functions from SQL worksheets in Snowsight. The analysts already have a role with USAGE on the required warehouse, database, and schema, and they can run standard SQL queries successfully. However, when they try to use Cortex AI functions, they receive authorization errors. The administrator wants to enable access using least privilege and without granting unnecessary account-wide administrative rights. What should the administrator do?
- A
Grant the SNOWFLAKE.CORTEX_USER database role to the analysts' role.
- B
Grant the ACCOUNTADMIN role to the analysts' role because Cortex AI features require account-level privileges.
- C
Grant OWNERSHIP on the SNOWFLAKE database to the analysts' role so they can execute Cortex AI functions.
- D
Enable a larger virtual warehouse size because Cortex AI functions require dedicated warehouse compute privileges beyond standard SQL access.
Show answer and explanation
Correct answer: A
Explanation
To enable Cortex AI features for users in a least-privilege manner, the administrator should grant the SNOWFLAKE.CORTEX_USER database role to the role used by those users. In practice, users also need the usual privileges to run queries in the target environment, such as access to the warehouse and relevant database objects, but those are already present in this scenario. The key missing requirement is the Cortex-specific authorization. This aligns with Snowflake guidance for enabling Cortex AI capabilities through the appropriate database role rather than broad administrative roles. Best practice is to grant only the privileges necessary for the user task, avoid powerful roles such as ACCOUNTADMIN for end-user access, and validate any regional or feature availability prerequisites documented for the specific Cortex functionality being used.
- A. Correct.
Correct. Access to Cortex AI functions is controlled through the SNOWFLAKE.CORTEX_USER database role. Granting this database role to the analysts' role is the least-privilege way to enable eligible users to invoke Cortex AI features, assuming other required object privileges and feature availability conditions are met.
- B. Incorrect.
Incorrect. ACCOUNTADMIN is not required for end users to use Cortex AI functions. Granting ACCOUNTADMIN would violate least-privilege principles and provides far broader account-wide authority than necessary. This is a common misconception when users see authorization errors and assume a high-level administrative role is needed.
- C. Incorrect.
Incorrect. Users do not need OWNERSHIP on the SNOWFLAKE database to use Cortex AI functions. OWNERSHIP is a powerful object privilege intended for managing objects, not for routine execution of AI functions. Granting it would be excessive and inappropriate for analyst access.
- D. Incorrect.
Incorrect. Warehouse sizing may affect performance or cost for some workloads, but it does not resolve authorization errors for Cortex AI access. The issue described is permission-related, not compute-capacity-related. Standard warehouse access alone is insufficient if the required Cortex-specific role has not been granted.