SnowPro Specialty: Gen AI Question 170
Single answerRequired privilegesA data engineering team is building a customer-support summarization pipeline in Snowflake. They created a Python stored procedure that calls Snowflake Cortex complete functions to summarize case notes and store the results in a table in the ANALYTICS schema. The procedure compiles successfully, but when an analyst role tries to execute it, the call fails with an authorization error related to AI functions. The security team wants to grant only the minimum additional privilege needed so analysts can run the procedure without broad administrative access. Which privilege should be granted to the analyst role?
- A
Grant USAGE on the SNOWFLAKE.CORTEX schema to the analyst role
- B
Grant CREATE MODEL on the ANALYTICS schema to the analyst role
- C
Grant SNOWFLAKE.CORTEX_USER database role to the analyst role
- D
Grant OPERATE on the warehouse used by the stored procedure to the analyst role
Show answer and explanation
Correct answer: C
Explanation
Snowflake Cortex access is controlled through Snowflake-provided database roles rather than ordinary schema USAGE alone. For users or roles that need to invoke Cortex AISQL capabilities such as text completion or summarization, the relevant privilege is typically granted by assigning the SNOWFLAKE.CORTEX_USER database role. This follows the principle of least privilege because it enables use of Cortex functions without granting unrelated object creation or administrative capabilities. In real implementations, the executing role also still needs normal privileges on the procedure, target tables, schemas, and warehouse, but those do not replace the Cortex-specific access requirement. This aligns with Snowflake documentation and best practices for managing access to Cortex LLM functions using Snowflake database roles.
- A. Incorrect.
Incorrect. Access to Cortex AISQL functions is not enabled by simply granting USAGE on the SNOWFLAKE.CORTEX schema. A common misconception is to treat Cortex like a regular schema-only object access problem. In practice, Snowflake uses database roles such as SNOWFLAKE.CORTEX_USER to control access to Cortex LLM-powered functions.
- B. Incorrect.
Incorrect. CREATE MODEL is related to creating model objects in supported ML workflows, not to invoking Snowflake Cortex complete or summarization capabilities from SQL or procedural code. Someone might choose this because the scenario involves AI, but the failure is specifically about permissions to use Cortex functions, not to create a model artifact.
- C. Correct.
Correct. To use Snowflake Cortex AISQL functions, the executing role needs the SNOWFLAKE.CORTEX_USER database role. In this scenario, the stored procedure execution fails specifically on the AI function call, so granting this database role is the minimum additional privilege needed for the analyst role to run the procedure successfully without broader admin rights.
- D. Incorrect.
Incorrect. OPERATE on a warehouse allows actions such as suspending or resuming the warehouse, but it does not authorize use of Cortex AI functions. This is a plausible distractor because stored procedures need compute, but warehouse operational privileges do not satisfy function-level AI access requirements.