Delegate role assignment permissions with WITH GRANT OPTION in Snowflake

You can now include the WITH GRANT OPTION clause when granting an account role or database role to another role. This allows the recipient role to further grant that role to other roles in the hierarchy. ### Use cases Imagine you need to delegate data team management to a tech lead without granting SECURITYADMIN privileges across the entire account. With this feature, you can grant an operational role with the option to delegate it further. - Grant roles with permission to pass them on to other roles - Remove only the delegation option without revoking base access - Control the removal of dependent privileges using CASCADE or RESTRICT ### How to use sql GRANT ROLE analyst TO ROLE data_steward WITH GRANT OPTION; What happens in this code: 1. The command assigns the analyst role to the data_steward role. 2. The WITH GRANT OPTION clause allows data_steward to grant the analyst role to other roles. 3. The recipient role inherits permissions and gains autonomy to manage this assignment. sql REVOKE GRANT OPTION FOR ROLE analyst FROM ROLE data_steward RESTRICT; What happens in this code: 1. The command specifically removes the delegation permission from the data_steward role over the analyst role. 2. The data_steward role retains the analyst role and its privileges. 3. The RESTRICT option prevents removal if there are active sub-grants made by data_steward. ### Limitations and requirements - Valid only for role-to-role grants (including database roles). - Direct grants to users (TO USER) do not support this clause. - The executing role must own the granted role or possess the global MANAGE GRANTS privilege.