User-managed Restricted Session Scope in CoCo

Restricted Session Scope (RSS) sets a privilege ceiling that limits what AI agents can do on behalf of a user in Snowflake. It prevents accidental production writes, privilege escalation, or access to sensitive data without replacing RBAC.

Use cases

Imagine you use CoCo to query production data and need to ensure the AI agent does not execute unintended modifications. With RSS, you can:

• Restrict individual CoCo chats to read-only access or selected roles.
• Set privilege ceilings account-wide or per-user using session policies.
• Block administrative roles such as ACCOUNTADMIN or SYSADMIN during agent sessions.

How to use

You can create an RSS object and reference it in a session policy or embed the YAML inline.

CREATE RESTRICTED SESSION SCOPE mydb.governance.agent_scope AS $$
privilege_scopes:
  allowed_privileges:
    - privileges: [data read, program usage]
      account: [all]
    - privileges: [data write]
      databases: [SANDBOX_DB, USER$]
role_scopes:
  blocked_roles: [ACCOUNTADMIN, SYSADMIN, SECURITYADMIN]
  allow_role_switching: true
$$;

CREATE SESSION POLICY mydb.governance.agent_policy
  AGENT_RESTRICTED_SESSION_SCOPE = 'MYDB.GOVERNANCE.AGENT_SCOPE';

What happens in this code:

1. Creates a restricted scope named agent_scope allowing data read and program usage account-wide, and data write only in SANDBOX_DB and the user's personal database (USER$).
2. Blocks administrative roles from being used by the agent.
3. Creates a session policy that applies this restricted scope.

Limitations and requirements

• Generally available (GA) in CoCo CLI, CoCo Desktop, and CoCo in Snowsight.
• An RSS activated for agent activity in a session is immutable for the lifetime of that session; to apply a different scope, open a new session.
• User-managed RSS can only narrow the privileges available through RBAC and admin-managed RSS.