SnowPro Specialty: Gen AI Question 19
Single answerRole-Based Access Control (RBAC)A data platform team is rolling out a Snowflake-based GenAI solution. They created a curated semantic view over support-ticket data and want a group of analysts to use Snowflake Cortex Analyst to ask natural-language questions against that semantic model. The security team requires least-privilege access: analysts must be able to use Cortex Analyst only for this model, and they must not receive broad object ownership or account-level administrative privileges. Which action should the team take to meet these requirements?
- A
Grant the analysts' role USAGE on the database and schema that contain the semantic view, plus the privileges required to query the underlying objects referenced by the semantic model.
- B
Grant the analysts' role OWNERSHIP on the semantic view so they can invoke Cortex Analyst without additional object-level privileges.
- C
Grant the analysts' role ACCOUNTADMIN so Cortex Analyst can inherit access to all referenced data sources at runtime.
- D
Grant the analysts' role CREATE CORTEX SEARCH SERVICE on the schema, because Cortex Analyst requires search-service creation privileges to read a semantic model.
Show answer and explanation
Correct answer: A
Explanation
This question tests practical RBAC design for GenAI workloads in Snowflake. Snowflake follows role-based access control, so access to Cortex Analyst is not granted by giving broad administrative roles; instead, users need the minimum privileges required on the relevant database objects used by the semantic model. In a least-privilege design, analysts should receive only the database/schema USAGE and the necessary read access to the semantic view and underlying referenced objects. Granting OWNERSHIP or ACCOUNTADMIN would overprivilege the users and create unnecessary security risk. Likewise, privileges for other GenAI features such as Cortex Search are not interchangeable with Cortex Analyst requirements. This aligns with Snowflake RBAC best practices: grant the smallest set of privileges needed for the task, use functional roles, and avoid assigning powerful system roles to end users unless absolutely necessary.
- A. Correct.
Correct. Snowflake access is governed through RBAC, so users need the appropriate privileges on the database and schema, as well as access to the objects the semantic model ultimately reads. For Cortex Analyst use, the practical least-privilege approach is to grant only the necessary USAGE and data-access privileges required for the semantic view and its referenced data, rather than elevated administrative rights.
- B. Incorrect.
Incorrect. OWNERSHIP is the highest object privilege and is not appropriate for a least-privilege analyst role. Ownership allows full control over the object, including grant management, and is not required just to query through Cortex Analyst.
- C. Incorrect.
Incorrect. ACCOUNTADMIN is an account-level administrative role and violates least-privilege principles. Cortex Analyst does not require users to hold broad administrative privileges simply to access an approved semantic model.
- D. Incorrect.
Incorrect. CREATE CORTEX SEARCH SERVICE is related to creating Cortex Search services, not to consuming a semantic model through Cortex Analyst. A common misconception is that all GenAI features share the same privilege model, but Cortex Analyst access is based on the underlying Snowflake object permissions needed for the semantic model.