## Grant Snowflake permissions

URL: https://docs.atlan.com/product/capabilities/governance/context-engineering-studio/how-tos/snowflake/grant-snowflake-permissions

> Grant the Snowflake permissions Context Engineering Studio needs to deploy a certified context repository to Snowflake Cortex Analyst. Required only at deploy time. You can connect, build, and simulate without them.

# Grant Snowflake permissions 

These Snowflake grants are required **only at deploy time**. You can [build a context repository](https://docs.atlan.com/llms/governance/context-engineering-studio/build/llms.txt) and [run simulations](https://docs.atlan.com/llms/governance/context-engineering-studio/simulate/llms.txt) without them. When you're ready to deploy to Snowflake Cortex Analyst, grant the **Atlan service account** the permissions to create the Semantic View, query Cortex Analyst, and run the warehouse. You only need to complete this step once per Snowflake account; subsequent context repositories on the same account don't require additional grants.

:::note Dedicated connector for production
For production, use a **dedicated Snowflake connector** for CES separate from your catalog crawling connector. This isolates deployment permissions from catalog permissions. Assets appear twice in the Atlan catalog since both connectors point to the same Snowflake account. This is expected.
:::

## Prerequisites

Before you begin, make sure:

- You have a certified context repository ready to deploy, or you're about to start a deploy. If you're still building or simulating, you can return to this guide later. Grants aren't needed yet.
- You have `ACCOUNTADMIN` access in Snowflake. Most grants on this page require it.
- You have the Atlan service role name. Contact your Atlan representative if you're unsure. Applying grants to the wrong role is the most common setup mistake.
- You have identified the target database and schema where Semantic Views are deployed, and the source schemas where your data tables live. These are often different.
- Permissions may already be applied. Run `SHOW GRANTS TO ROLE <atlan_role>;` in Snowflake. If `CREATE SEMANTIC VIEW`, `CORTEX_USER`, `USAGE ON WAREHOUSE`, and `REFERENCES` on semantic views are listed, skip this guide and go to [Deploy](https://docs.atlan.com/llms/governance/context-engineering-studio/deploy-snowflake/llms.txt).

## Apply grants

### Step by step

Run these as a user with `ACCOUNTADMIN` access in Snowflake.

1. Grant **Create semantic views** to let CES deploy your context repository as a Snowflake Semantic View.

 ```sql
 GRANT USAGE ON DATABASE <target_database> TO ROLE <atlan_role>;
 GRANT USAGE ON SCHEMA <target_database>.<target_schema> TO ROLE <atlan_role>;
 GRANT CREATE SEMANTIC VIEW ON SCHEMA <target_database>.<target_schema> TO ROLE <atlan_role>;
 ```

2. Grant **Cortex Analyst access** to let CES invoke Cortex Analyst for natural language to SQL during Chat & build and simulations.

 Grants access to all Cortex features including Cortex Analyst, Cortex Search, and others.

 ```sql
 USE ROLE ACCOUNTADMIN;
 GRANT DATABASE ROLE SNOWFLAKE.CORTEX_USER TO ROLE <atlan_role>;
 ```

### Cortex Analyst only

Grants access to Cortex Analyst only. Use this option if you prefer least-privilege access, CES only requires Cortex Analyst.

 ```sql
 USE ROLE ACCOUNTADMIN;
 GRANT DATABASE ROLE SNOWFLAKE.CORTEX_ANALYST_USER TO ROLE <atlan_role>;
 ```

3. Grant **warehouse access** to let CES execute SQL for Chat & build, simulations, and evaluations.

 ```sql
 GRANT USAGE ON WAREHOUSE <warehouse_name> TO ROLE <atlan_role>;
 ```

 :::tip
 Chat & build and Simulate run complex, multi-step SQL queries. For best results, use a **Large** or larger warehouse. If the warehouse is too small, queries may time out during simulation. Warehouse selection is set at the connector level, you can't change it per session in CES.
 :::

4. Grant **Read access to semantic view metadata** to let CES crawl and index deployed semantic views into the Atlan catalog.

### INFORMATION_SCHEMA (recommended)

Captures semantic view DDL, which is required for full catalog visibility in Atlan.

 ```sql
 GRANT USAGE ON ALL SCHEMAS IN DATABASE <target_database> TO ROLE <atlan_role>;
 GRANT REFERENCES ON ALL SEMANTIC VIEWS IN DATABASE <target_database> TO ROLE <atlan_role>;

 -- Future grants
 GRANT USAGE ON FUTURE SCHEMAS IN DATABASE <target_database> TO ROLE <atlan_role>;
 GRANT REFERENCES ON FUTURE SEMANTIC VIEWS IN DATABASE <target_database> TO ROLE IDENTIFIER(<atlan_role>);
 ```

### ACCOUNT_USAGE

```sql
 USE ROLE ACCOUNTADMIN;
 GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE <atlan_role>;
 ```

 :::warning
 This option alone is **not sufficient** to capture semantic view DDL. Use INFORMATION_SCHEMA if you need DDL visibility in the Atlan catalog.
 :::

5. Grant **SELECT on source tables and views** (optional). This lets CES pull sample values and run simulations on live data. Without this, CES can build and score semantic models but can't validate results on live data.

 Apply these grants on the schemas where your **source data tables live**, not the deployment schema from step 1, which typically contains no data tables.

 ```sql
 -- Existing objects
 GRANT SELECT ON ALL TABLES IN SCHEMA <source_database>.<source_schema> TO ROLE <atlan_role>;
 GRANT SELECT ON ALL VIEWS IN SCHEMA <source_database>.<source_schema> TO ROLE <atlan_role>;

 -- Future objects
 GRANT SELECT ON FUTURE TABLES IN SCHEMA <source_database>.<source_schema> TO ROLE <atlan_role>;
 GRANT SELECT ON FUTURE VIEWS IN SCHEMA <source_database>.<source_schema> TO ROLE <atlan_role>;
 ```

 Repeat for each source schema you want CES to query. If your context repository spans multiple schemas, apply these grants to each one.

### All grants at once

Run the following as `ACCOUNTADMIN` in your Snowflake account. Before running, replace:

- `ATLAN_USER_ROLE` with your Atlan service role name
- `MY_WAREHOUSE` with your Atlan connector warehouse name
- `MY_DATABASE` with your target database
- `MY_SCHEMA` with your target schema
- `MY_SOURCE_DATABASE` and `MY_SOURCE_SCHEMA` with the database and schema where your source data tables live (often different from the deployment target)

```sql
-- ============================================================
-- Context Engineering Studio: Snowflake Permissions Setup
-- Run as ACCOUNTADMIN
-- ============================================================

-- Set your values here
SET atlan_role = 'ATLAN_USER_ROLE';
SET warehouse = 'MY_WAREHOUSE';
SET target_db = 'MY_DATABASE';
SET target_schema = 'MY_SCHEMA';
SET full_schema = $target_db || '.' || $target_schema;
SET source_db = 'MY_SOURCE_DATABASE';
SET source_schema = 'MY_SOURCE_SCHEMA';
SET full_source_schema = $source_db || '.' || $source_schema;

-- 1. USAGE on deployment database and schema
GRANT USAGE ON DATABASE IDENTIFIER($target_db) TO ROLE IDENTIFIER($atlan_role);
GRANT USAGE ON SCHEMA IDENTIFIER($full_schema) TO ROLE IDENTIFIER($atlan_role);

-- 2. CREATE SEMANTIC VIEW
GRANT CREATE SEMANTIC VIEW ON SCHEMA IDENTIFIER($full_schema) TO ROLE IDENTIFIER($atlan_role);

-- 3. Cortex Analyst access
USE ROLE ACCOUNTADMIN;
GRANT DATABASE ROLE SNOWFLAKE.CORTEX_ANALYST_USER TO ROLE IDENTIFIER($atlan_role);

-- 4. Warehouse access (required for Chat & build, simulations, and evaluations)
GRANT USAGE ON WAREHOUSE IDENTIFIER($warehouse) TO ROLE IDENTIFIER($atlan_role);

-- 5. Semantic view crawling (INFORMATION_SCHEMA method, recommended)
GRANT USAGE ON ALL SCHEMAS IN DATABASE IDENTIFIER($target_db) TO ROLE IDENTIFIER($atlan_role);
GRANT REFERENCES ON ALL SEMANTIC VIEWS IN DATABASE IDENTIFIER($target_db) TO ROLE IDENTIFIER($atlan_role);
GRANT USAGE ON FUTURE SCHEMAS IN DATABASE IDENTIFIER($target_db) TO ROLE IDENTIFIER($atlan_role);
GRANT REFERENCES ON FUTURE SEMANTIC VIEWS IN DATABASE IDENTIFIER($target_db) TO ROLE IDENTIFIER($atlan_role);

-- 6. SELECT on source tables and views (optional, required for simulations)
-- Repeat for each source schema in your context repository
GRANT SELECT ON ALL TABLES IN SCHEMA IDENTIFIER($full_source_schema) TO ROLE IDENTIFIER($atlan_role);
GRANT SELECT ON ALL VIEWS IN SCHEMA IDENTIFIER($full_source_schema) TO ROLE IDENTIFIER($atlan_role);
GRANT SELECT ON FUTURE TABLES IN SCHEMA IDENTIFIER($full_source_schema) TO ROLE IDENTIFIER($atlan_role);
GRANT SELECT ON FUTURE VIEWS IN SCHEMA IDENTIFIER($full_source_schema) TO ROLE IDENTIFIER($atlan_role);
```

## Verify permissions with preflight check

After applying grants, use the **Configure** tab in CES to run a preflight check and confirm the Atlan service role has everything it needs before you deploy. The preflight check verifies:

- **Authentication:** the service account can connect to Snowflake with the configured credentials
- **Warehouse access:** the role has `USAGE` on the configured warehouse
- **Schema access:** the role has `USAGE` on the target database and schema
- **Create permission:** the role can create semantic views in the target schema
- **Cortex access:** the role has the `CORTEX_USER` or `CORTEX_ANALYST_USER` database role

If any check fails, the preflight reports exactly which permission is missing. Fix the grant and re-run the check before deploying.

## Next steps

- [Deploy to Snowflake](https://docs.atlan.com/llms/governance/context-engineering-studio/deploy-snowflake/llms.txt): certify and push your context repository to Snowflake Cortex Analyst.

---