S
Integration · Data warehouse
Govern your Snowflake agent.
Agents query analytics models while governance masks PII and blocks unbounded extraction.
The risk
What can go wrong when an agent holds Snowflake.
A raw Snowflake token lets an agent do anything the token can — no boundary, no record. These are the actions you don't want it taking on its own.
- Querying raw PII tables
- Exfiltrating large result sets
- Creating/altering warehouses (cost)
- Granting roles to themselves
The HiveKey policy
Scope it. Guard it. Log it.
Give the agent a role with exactly the Snowflake actions it needs, then guard the rest in the path.
Scope — granted
- select:ANALYTICS.MARTS.*
Guard — enforced
- Mask PII columns
- Result-row cap 5,000
- Deny GRANT and warehouse DDL
The proof
Every Snowflake action — allowed or denied — on one trail.
snowflake-agent · action log live
select marts.revenue_daily scope: marts read allow
select raw.customers_pii guard: PII not granted deny
Put your Snowflake agent under one policy.
See HiveKey scope, guard, and log your Snowflake agent and the rest of your fleet.