SnowPro Specialty: Gen AI Question 20
Single answerRole-Based Access Control (RBAC)A healthcare company is building an internal GenAI assistant in Snowflake. Data scientists need to develop and test prompts against a curated set of de-identified patient notes, but the security team must ensure the developers cannot read raw production PHI tables. The team also wants to follow least-privilege principles and avoid granting broad account-level administrative roles. Which approach best meets these requirements?
- A
Grant the developers the ACCOUNTADMIN role so they can use all AI-related features, then rely on application logic to hide the raw PHI tables.
- B
Create a custom role for the developers, grant it only the privileges needed to use the curated de-identified dataset and required GenAI objects, and avoid granting access to the raw PHI schema.
- C
Grant the PUBLIC role access to the de-identified dataset and AI functions so prompt development works without additional role management.
- D
Assign the SECURITYADMIN role to the developers so they can manage their own access to GenAI objects while avoiding SYSADMIN.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to create a custom role that grants only the permissions needed for the developers' GenAI workflow and only on approved, de-identified data assets. In Snowflake RBAC, access should be granted through roles rather than through application-layer assumptions. Least privilege and separation of duties are key best practices: developers should be able to use curated data and any required AI or database objects, but they should not receive direct privileges on raw production PHI schemas. Broad administrative roles such as ACCOUNTADMIN or SECURITYADMIN are inappropriate for routine development tasks. Similarly, granting privileges to PUBLIC is too permissive for controlled GenAI use cases. This aligns with Snowflake guidance on role-based access control, custom role design, and limiting access to sensitive data through object-level privilege grants.
- A. Incorrect.
Incorrect. ACCOUNTADMIN is far broader than required and violates least-privilege practices. In Snowflake, ACCOUNTADMIN is a highly privileged role intended for a very limited set of administrators. Relying on application logic to hide PHI is not an RBAC control and does not prevent direct access if a user already has underlying privileges.
- B. Correct.
Correct. This is the standard Snowflake RBAC approach: create a custom functional role, grant only the necessary privileges on the de-identified data and any required GenAI-related objects, and explicitly withhold privileges on raw PHI objects. This supports separation of duties, minimizes blast radius, and aligns with least-privilege access design.
- C. Incorrect.
Incorrect. Granting access to PUBLIC is generally inappropriate for sensitive or even moderately controlled datasets because PUBLIC is available to every user in the account. Even if the dataset is de-identified, broad access undermines controlled governance and is inconsistent with least-privilege design.
- D. Incorrect.
Incorrect. SECURITYADMIN is also a powerful administrative role and should not be assigned to developers simply to let them manage their own access. That would allow privilege administration well beyond what is needed for prompt development and testing, creating unnecessary security risk.