SnowPro Specialty: Gen AI Question 23
Single answerRequired privilegesA data engineering team is building an internal summarization app in Snowflake that calls Snowflake Cortex LLM functions from SQL. The security team requires least-privilege access and wants developers to use a dedicated role rather than ACCOUNTADMIN. A developer reports that their SQL worksheet can read the source table, but every call to a Cortex LLM function fails with an access error. Which privilege should the administrator grant to the developer's role to allow the role to invoke Snowflake Cortex LLM functions?
- A
Grant USAGE on the warehouse used to run the query
- B
Grant CREATE CORTEX SEARCH SERVICE on the schema containing the source table
- C
Grant SNOWFLAKE.CORTEX_USER database role to the developer's role
- D
Grant EXECUTE TASK on the database where the source table resides
Show answer and explanation
Correct answer: C
Explanation
The key issue is that access to source data and warehouse compute is not sufficient to use Snowflake Cortex LLM functions. Snowflake separates object access from AI function access. For Cortex LLM function invocation, the required access is typically granted through the SNOWFLAKE.CORTEX_USER database role. This aligns with least-privilege administration: grant developers only the warehouse, database/schema/table privileges they need for data access, plus the Cortex database role required to invoke AI functions. CREATE CORTEX SEARCH SERVICE applies to creating search services, and EXECUTE TASK applies to task orchestration, so neither resolves direct LLM invocation errors. This reflects Snowflake guidance on required privileges for Cortex features and the use of database roles to control access.
- A. Incorrect.
Incorrect. USAGE on the warehouse is necessary to run compute-backed SQL statements, but it does not authorize use of Snowflake Cortex LLM functions by itself. A role can have warehouse access and still be blocked from invoking Cortex functions if it lacks the required Cortex-related privilege or database role.
- B. Incorrect.
Incorrect. CREATE CORTEX SEARCH SERVICE is related to creating Cortex Search services, not invoking Snowflake Cortex LLM functions such as summarization, completion, or similar inference functions from SQL. This distractor reflects a common confusion between Cortex Search administration and Cortex model function access.
- C. Correct.
Correct. To invoke Snowflake Cortex LLM functions, the role needs the SNOWFLAKE.CORTEX_USER database role. In practice, an administrator grants this database role to the application or developer role that should be allowed to call Cortex functions. This is the specific access control requirement the scenario is missing.
- D. Incorrect.
Incorrect. EXECUTE TASK allows a role to run tasks or own task execution behavior, but it is unrelated to permission to call Cortex LLM functions. Someone might choose this if they associate scheduled pipelines with AI workflows, but the failure described occurs during direct SQL function invocation, not task execution.