SnowPro Specialty: Gen AI Question 216
Single answer3.1 Set up model access controls.A Snowflake administrator is enabling Cortex AISQL for a finance analytics team. The team should be able to call supported LLM functions from their own schema, but only approved users should have access to the underlying model capabilities. The administrator also wants to follow least-privilege principles and avoid granting broad account-wide rights. Which action should the administrator take?
- A
Grant the SNOWFLAKE.CORTEX_USER database role to a custom role assigned only to the approved finance users, then grant the necessary usage privileges for the database, schema, warehouse, and function execution context they will use.
- B
Grant ACCOUNTADMIN to the finance team temporarily so they can test Cortex AISQL functions, then revoke it after validation is complete.
- C
Grant USAGE on the SNOWFLAKE database to the finance team, because access to the SNOWFLAKE database automatically permits use of all Cortex models.
- D
Create a network policy that allows only the finance team’s office IP range, because model access in Cortex AISQL is controlled primarily through network policies.
Show answer and explanation
Correct answer: A
Explanation
To set up model access controls for Snowflake Cortex AISQL, administrators should use role-based access control and grant the SNOWFLAKE.CORTEX_USER database role only to approved roles or users. This aligns with least-privilege security practices and allows organizations to restrict who can invoke LLM-powered SQL functions. In addition to model access, users still require standard Snowflake object privileges such as USAGE on the database, schema, and warehouse used in execution. Broad administrative grants such as ACCOUNTADMIN are not appropriate for this purpose, and network policies are complementary security controls rather than the main mechanism for model authorization. This reflects Snowflake guidance for controlling access to Cortex features using RBAC and scoped privilege assignment.
- A. Correct.
Correct. Access to Snowflake Cortex AISQL model capabilities is controlled through the SNOWFLAKE.CORTEX_USER database role. Following best practice, the administrator should grant this role only to a custom role used by the approved users rather than assigning broad administrative roles. Users also still need the standard privileges required to run SQL in their target objects, such as USAGE on the relevant database, schema, and warehouse, depending on how they invoke the functions.
- B. Incorrect.
Incorrect. Granting ACCOUNTADMIN violates least-privilege principles and is unnecessary for using Cortex AISQL functions. Administrative roles provide far more access than needed and create security and governance risk.
- C. Incorrect.
Incorrect. USAGE on the SNOWFLAKE database alone does not grant permission to use Cortex model functions. Model access is not unlocked simply by database visibility; the relevant Cortex access role must also be granted.
- D. Incorrect.
Incorrect. Network policies can restrict where users connect from, but they do not serve as the primary authorization mechanism for Cortex AISQL model access. Model access is governed through Snowflake roles and privileges, including the SNOWFLAKE.CORTEX_USER database role.