Restricted Session Scope for agents in Snowflake

Use cases

Imagine your AI agents inherit full user privileges, including write access to production databases or access to sensitive data, creating governance risks. Restricted Session Scope (RSS) acts as a privilege ceiling that limits what an agent can do on behalf of a user without modifying their RBAC.

With it, you can:

• Set read-only limits on production data while retaining personal database access.
• Block administrative roles and reduce unintended writes.
• Use predefined scopes or build custom rules via YAML.

How to use

You can create a dedicated RSS object and reference it in a session policy, or embed the YAML inline.

CREATE RESTRICTED SESSION SCOPE mydb.governance.agent_scope AS $$
privilege_scopes:
  allowed_privileges:
    - privileges: [data read, program usage]
      account: [all]
    - privileges: [data write]
      databases: [SANDBOX_DB, USER$]
role_scopes:
  blocked_roles: [ACCOUNTADMIN, SYSADMIN, SECURITYADMIN]
  allow_role_switching: true
$$;

CREATE SESSION POLICY mydb.governance.agent_policy
  AGENT_RESTRICTED_SESSION_SCOPE = 'MYDB.GOVERNANCE.AGENT_SCOPE';

What happens in this code:

1. Creates a restricted session scope named agent_scope allowing read and program usage account-wide, and write access only in sandboxes and personal user databases.
2. Blocks high-privilege roles like ACCOUNTADMIN from being used by the agent.
3. Creates a session policy enforcing this scope.

To apply the policy account-wide:

ALTER ACCOUNT SET SESSION POLICY mydb.governance.agent_policy;

What happens in this code:

1. Attaches the agent session policy to the account level.
2. Automatically restricts any active agent session according to the defined rules.

Limitations and requirements

• Generally Available (GA).
• RSS restrictions apply only when an agent is active in the session.
• Creating an RSS object requires the CREATE RESTRICTED SESSION SCOPE privilege on the parent schema.