SnowPro Specialty: Gen AI Question 24
Single answerRequired privilegesA data engineering team is building a customer-support summarization pipeline in Snowflake. They created a table of support cases and want an analyst-facing role, ANALYST_GENAI, to run SQL statements that call SNOWFLAKE.CORTEX.COMPLETE to generate summaries and sentiment labels directly in worksheets. The security team wants to follow least-privilege principles and avoid granting unnecessary administrative rights. Which privilege is specifically required for the ANALYST_GENAI role to invoke SNOWFLAKE.CORTEX.COMPLETE, assuming the role already has the necessary warehouse, database, schema, and table access?
- A
Grant USAGE on the SNOWFLAKE.CORTEX schema to ANALYST_GENAI
- B
Grant the SNOWFLAKE.CORTEX_USER database role to ANALYST_GENAI
- C
Grant CREATE MODEL on the target schema to ANALYST_GENAI
- D
Grant EXECUTE TASK on the warehouse used by ANALYST_GENAI
Show answer and explanation
Correct answer: B
Explanation
For Snowflake Cortex AISQL features, access is typically controlled through Snowflake-provided database roles rather than broad object-creation privileges. In this scenario, the key missing permission is the SNOWFLAKE.CORTEX_USER database role, which allows the role to call functions such as SNOWFLAKE.CORTEX.COMPLETE. This aligns with least-privilege best practice because it grants only the feature access required, instead of administrative capabilities like CREATE MODEL or unrelated operational permissions like EXECUTE TASK. Candidates should distinguish between standard SQL object privileges, task privileges, and Snowflake-managed feature entitlements. Refer to Snowflake documentation for Cortex AISQL access control and required database roles for current privilege requirements.
- A. Incorrect.
Incorrect. Although object access is often granted with USAGE on databases and schemas, Cortex AISQL functions such as SNOWFLAKE.CORTEX.COMPLETE are controlled through Snowflake-provided database roles rather than by directly granting a schema-level privilege on SNOWFLAKE.CORTEX for this purpose. This option reflects a common misconception that all callable functions are enabled only through schema USAGE.
- B. Correct.
Correct. To use Snowflake Cortex AISQL functions such as SNOWFLAKE.CORTEX.COMPLETE, the role must be granted the appropriate Snowflake database role, specifically SNOWFLAKE.CORTEX_USER. This is the least-privilege, feature-specific access model Snowflake uses for Cortex function invocation.
- C. Incorrect.
Incorrect. CREATE MODEL is related to creating machine learning model objects in supported workflows, not to invoking managed Cortex AISQL functions like COMPLETE. Someone might choose this because the scenario involves AI functionality, but generating text with Cortex does not require model creation privileges.
- D. Incorrect.
Incorrect. EXECUTE TASK is only relevant when a role needs to run or manage tasks. In this scenario, the analyst is issuing interactive SQL in worksheets, not operating tasks. Warehouse access is needed to run queries, but EXECUTE TASK on a warehouse is not the privilege that enables Cortex COMPLETE.