SnowPro Specialty: Gen AI Question 169
Single answerRequired privilegesA data engineering team is building a customer-support assistant in Snowflake that uses Cortex LLM functions from a worksheet and a Streamlit app. The SECURITYADMIN has already granted the team role USAGE on the database, schema, warehouse, and the Streamlit app's stage dependencies. However, when developers run AI_COMPLETE and other Cortex LLM functions, they receive an insufficient privileges error. Which additional privilege must be granted to the role to allow use of Snowflake Cortex LLM functions?
- A
Grant the CREATE CORTEX SEARCH SERVICE privilege on the schema
- B
Grant the SNOWFLAKE.CORTEX_USER database role to the team role
- C
Grant OWNERSHIP on the warehouse used by the worksheet and Streamlit app
- D
Grant CREATE MODEL on the schema that stores application objects
Show answer and explanation
Correct answer: B
Explanation
Snowflake Cortex LLM functions require more than standard object access. In addition to typical privileges such as USAGE on the relevant warehouse, database, and schema, the executing role must have the SNOWFLAKE.CORTEX_USER database role to call Cortex LLM functions. This is a common operational issue when teams can access worksheets or Streamlit apps but still cannot invoke AI_COMPLETE or related Cortex functions. By contrast, privileges such as CREATE CORTEX SEARCH SERVICE or CREATE MODEL apply to different AI/ML capabilities and do not authorize use of Cortex LLM inference functions. Following least-privilege best practices, administrators should grant SNOWFLAKE.CORTEX_USER only to roles that need to use Cortex LLM features, rather than broader privileges such as OWNERSHIP.
- A. Incorrect.
Incorrect. CREATE CORTEX SEARCH SERVICE is used to create Cortex Search services, which is a separate capability from invoking Snowflake Cortex LLM functions such as AI_COMPLETE. A team that only needs to call LLM functions does not need object-creation privileges for Cortex Search.
- B. Correct.
Correct. To use Snowflake Cortex LLM functions, the executing role must be granted the SNOWFLAKE.CORTEX_USER database role. This is the key required privilege in addition to normal access privileges on the database, schema, and compute resources used by the application.
- C. Incorrect.
Incorrect. OWNERSHIP on a warehouse is far more privilege than required and is not needed to execute Cortex LLM functions. In practice, USAGE on the warehouse is typically sufficient for running queries or app workloads, assuming the role also has the required Cortex access role.
- D. Incorrect.
Incorrect. CREATE MODEL is related to model object creation workflows and does not grant permission to invoke Snowflake-managed Cortex LLM functions. This distractor reflects a common misconception that all AI features require model-creation privileges.