Roles Grant Capabilities, Not Status
Explain how least privilege changes Snowflake role design.
A Snowflake role should answer "what job can this identity perform?" not "how important is this person?" The mechanism Roles Grant Capabilities, Not Status works because Snowflake separates stored data, compute, access, and metadata into different levers. The practical mechanism is not magic speed; it is choosing the right lever for the job, reading the evidence, and changing one control at a time. Role design is a least-privilege design exercise. In Snowflake, a user activates a role, and that role carries privileges on warehouses, databases, schemas, and objects. The mechanism is compositional: small object grants accumulate through role hierarchy. That…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in