✦TL;DR

Grant the Snowflake permissions Context Engineering Studio needs to deploy a context repository to Snowflake Cortex Analyst. Required only at deploy time. You can connect and build without them.

||

Your AI can read this via Docs MCPcurl -fsSL "https://docs.atlan.com/install-docs-mcp" | bashConnect

Grant Snowflake permissions

These Snowflake grants are required only at deploy time. You can build a context repository without them. When you're ready to deploy to Snowflake Cortex Analyst, grant the Atlan service account the permissions to create the Semantic View, query Cortex Analyst, and run the warehouse. You only need to complete this step once per Snowflake account; subsequent context repositories on the same account don't require additional grants.

Dedicated connector for production

For production, use a dedicated Snowflake connector for CES separate from your catalog crawling connector. This isolates deployment permissions from catalog permissions. Assets appear twice in the Atlan catalog since both connectors point to the same Snowflake account. This is expected.

Prerequisites

Before you begin, make sure:

• You have an active context repository ready to deploy, or you're about to start a deploy. If you're still building, you can return to this guide later. Grants aren't needed yet.
• You have ACCOUNTADMIN access in Snowflake. Most grants on this page require it.
• You have the Atlan service role name. Contact your Atlan representative if you're unsure. Applying grants to the wrong role is the most common setup mistake.
• You have identified the target database and schema where Semantic Views are deployed.
• Permissions may already be applied. Run SHOW GRANTS TO ROLE <atlan_role>; in Snowflake. If CREATE SEMANTIC VIEW, CORTEX_USER, USAGE ON WAREHOUSE, and REFERENCES on semantic views are listed, skip this guide and go to Deploy.

Apply grants

Step by step

Run these as a user with ACCOUNTADMIN access in Snowflake.

1. Grant Create semantic views to let CES deploy your context repository as a Snowflake Semantic View.

   GRANT USAGE ON DATABASE <target_database> TO ROLE <atlan_role>;
   GRANT USAGE ON SCHEMA <target_database>.<target_schema> TO ROLE <atlan_role>;
   GRANT CREATE SEMANTIC VIEW ON SCHEMA <target_database>.<target_schema> TO ROLE <atlan_role>;

2. Grant Cortex Analyst access so Cortex Analyst can answer questions on the deployed semantic view. The preflight check requires this grant.

   All Cortex features

   Grants access to all Cortex features including Cortex Analyst, Cortex Search, and others.

   USE ROLE ACCOUNTADMIN;
   GRANT DATABASE ROLE SNOWFLAKE.CORTEX_USER TO ROLE <atlan_role>;

   Cortex Analyst only

   Grants access to Cortex Analyst only. Use this option if you prefer least-privilege access, CES only requires Cortex Analyst.

   USE ROLE ACCOUNTADMIN;
   GRANT DATABASE ROLE SNOWFLAKE.CORTEX_ANALYST_USER TO ROLE <atlan_role>;

3. Grant warehouse access to let CES run the deployment statements.

   GRANT USAGE ON WAREHOUSE <warehouse_name> TO ROLE <atlan_role>;

4. Grant Read access to semantic view metadata to let CES crawl and index deployed semantic views into the Atlan catalog.

   INFORMATION_SCHEMA (recommended)

   Captures semantic view DDL, which is required for full catalog visibility in Atlan.

   GRANT USAGE ON ALL SCHEMAS IN DATABASE <target_database> TO ROLE <atlan_role>;
   GRANT REFERENCES ON ALL SEMANTIC VIEWS IN DATABASE <target_database> TO ROLE <atlan_role>;
   
   -- Future grants
   GRANT USAGE ON FUTURE SCHEMAS IN DATABASE <target_database> TO ROLE <atlan_role>;
   GRANT REFERENCES ON FUTURE SEMANTIC VIEWS IN DATABASE <target_database> TO ROLE IDENTIFIER(<atlan_role>);

   ACCOUNT_USAGE

   USE ROLE ACCOUNTADMIN;
   GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE <atlan_role>;

   warning

   This option alone is not sufficient to capture semantic view DDL. Use INFORMATION_SCHEMA if you need DDL visibility in the Atlan catalog.

All grants at once

Run the following as ACCOUNTADMIN in your Snowflake account. Before running, replace:

• ATLAN_USER_ROLE with your Atlan service role name
• MY_WAREHOUSE with your Atlan connector warehouse name
• MY_DATABASE with your target database
• MY_SCHEMA with your target schema

-- ============================================================
-- Context Engineering Studio: Snowflake Permissions Setup
-- Run as ACCOUNTADMIN
-- ============================================================

-- Set your values here
SET atlan_role = 'ATLAN_USER_ROLE';
SET warehouse = 'MY_WAREHOUSE';
SET target_db = 'MY_DATABASE';
SET target_schema = 'MY_SCHEMA';
SET full_schema = $target_db || '.' || $target_schema;

-- 1. USAGE on deployment database and schema
GRANT USAGE ON DATABASE IDENTIFIER($target_db) TO ROLE IDENTIFIER($atlan_role);
GRANT USAGE ON SCHEMA IDENTIFIER($full_schema) TO ROLE IDENTIFIER($atlan_role);

-- 2. CREATE SEMANTIC VIEW
GRANT CREATE SEMANTIC VIEW ON SCHEMA IDENTIFIER($full_schema) TO ROLE IDENTIFIER($atlan_role);

-- 3. Cortex Analyst access
USE ROLE ACCOUNTADMIN;
GRANT DATABASE ROLE SNOWFLAKE.CORTEX_ANALYST_USER TO ROLE IDENTIFIER($atlan_role);

-- 4. Warehouse access (required to run deployment statements)
GRANT USAGE ON WAREHOUSE IDENTIFIER($warehouse) TO ROLE IDENTIFIER($atlan_role);

-- 5. Semantic view crawling (INFORMATION_SCHEMA method, recommended)
GRANT USAGE ON ALL SCHEMAS IN DATABASE IDENTIFIER($target_db) TO ROLE IDENTIFIER($atlan_role);
GRANT REFERENCES ON ALL SEMANTIC VIEWS IN DATABASE IDENTIFIER($target_db) TO ROLE IDENTIFIER($atlan_role);
GRANT USAGE ON FUTURE SCHEMAS IN DATABASE IDENTIFIER($target_db) TO ROLE IDENTIFIER($atlan_role);
GRANT REFERENCES ON FUTURE SEMANTIC VIEWS IN DATABASE IDENTIFIER($target_db) TO ROLE IDENTIFIER($atlan_role);

Verify permissions with preflight check

After applying grants, use the Configure tab in CES to run a preflight check and confirm the Atlan service role has everything it needs before you deploy. The preflight check verifies:

• Authentication: the service account can connect to Snowflake with the configured credentials
• Warehouse access: the role has USAGE on the configured warehouse
• Schema access: the role has USAGE on the target database and schema
• Create permission: the role can create semantic views in the target schema
• Cortex access: the role has the CORTEX_USER or CORTEX_ANALYST_USER database role

If any check fails, the preflight reports exactly which permission is missing. Fix the grant and re-run the check before deploying.

Next steps

• Deploy to Snowflake: push your context repository to Snowflake Cortex Analyst.