Snowflake Cortex AI Functions Model RBAC Rollout (Preview)¶

The following Snowflake Cortex AI Functions now fully enforce model access controls through both the CORTEX_MODELS_ALLOWLIST parameter and model role-based access control (RBAC):

• AI_TRANSCRIBE / SNOWFLAKE.CORTEX.TRANSCRIBE

• AI_EXTRACT / SNOWFLAKE.CORTEX.EXTRACT

• AI_SENTIMENT / SNOWFLAKE.CORTEX.SENTIMENT / SNOWFLAKE.CORTEX.ENTITY_SENTIMENT

• AI_TRANSLATE / SNOWFLAKE.CORTEX.TRANSLATE

• CLASSIFY_TEXT

• SUMMARIZE

• EXTRACT_ANSWER

• AI_PARSE_DOCUMENT / SNOWFLAKE.CORTEX.PARSE_DOCUMENT

• AI_REDACT

Before the change:

Model access controls, CORTEX_MODELS_ALLOWLIST and model RBAC, were fully enforced for AI_COMPLETE / SNOWFLAKE.CORTEX.COMPLETE, AI_CLASSIFY, AI_FILTER, AI_AGG , and AI_SUMMARIZE_AGG.

For the preceding Snowflake Cortex AI Functions, model access controls were not enforced. Queries using these functions could succeed even when the underlying model was restricted by CORTEX_MODELS_ALLOWLIST or model RBAC.

After the change:

When you call any of the listed Snowflake Cortex AI Functions, Snowflake will:

1. Check model RBAC first: If the calling role has usage on the corresponding model object (for example, via SNOWFLAKE."CORTEX-MODEL-ROLE-ARCTIC-TRANSLATE"), the call is allowed.

2. If no model object access is found, check CORTEX_MODELS_ALLOWLIST: If the underlying model or alias is listed in CORTEX_MODELS_ALLOWLIST, or if CORTEX_MODELS_ALLOWLIST = 'All', the call is allowed.

3. Otherwise, the call fails with a model-authorization error.

This aligns behavior across all listed Snowflake Cortex AI Functions and ensures that your existing model restrictions are respected consistently.

Note

If you’re affected by this change:

You’re affected if you’ve set the CORTEX_MODELS_ALLOWLIST parameter to a different value from the default All value and you use any of the preceding Snowflake Cortex AI Functions.

If you haven’t changed the value for the allowlist parameter and you’re not using model RBAC, you won’t see any behavioral changes.

If you’ve customized CORTEX_MODELS_ALLOWLIST, affected queries might start failing with a model-authorization error unless:

• The underlying model or its function-specific alias is permitted by CORTEX_MODELS_ALLOWLIST, or

• The role executing the query has the corresponding model application role.

To prepare for this change:

1. Check which affected functions you use:

   SELECT DISTINCT FUNCTION_NAME
   FROM SNOWFLAKE.ACCOUNT_USAGE.CORTEX_AISQL_USAGE_HISTORY
   WHERE USAGE_TIME >= DATEADD(day, -90, CURRENT_TIMESTAMP())
     AND FUNCTION_NAME IN (
         'AI_TRANSCRIBE', 'TRANSCRIBE', 'AI_EXTRACT', 'AI_SENTIMENT',
         'SENTIMENT', 'ENTITY_SENTIMENT', 'AI_TRANSLATE', 'TRANSLATE',
         'CLASSIFY_TEXT', 'SUMMARIZE', 'EXTRACT_ANSWER',
         'AI_PARSE_DOCUMENT', 'PARSE_DOCUMENT', 'AI_REDACT'
     )
   ORDER BY FUNCTION_NAME;
   

   Copy

2. Review your current model governance settings:

   SHOW PARAMETERS LIKE 'CORTEX_MODELS_ALLOWLIST' IN ACCOUNT;
   

   Copy

3. If using an allowlist (not All), add the required model aliases for the functions you use. Common model aliases include:

   • arctic-translate (for AI_TRANSLATE)

   • arctic-transcribe (for AI_TRANSCRIBE)

   • arctic-extract (for AI_EXTRACT)

   • arctic-parse-document (for AI_PARSE_DOCUMENT)

   • arctic-extract-answer (for EXTRACT_ANSWER)

   • arctic-sentiment (for AI_SENTIMENT)

   • arctic-summarize (for SUMMARIZE)

   • llama3.1-70b (for CLASSIFY_TEXT, AI_REDACT)

   • mistral-7b (for SUMMARIZE)

   Example:

   ALTER ACCOUNT SET CORTEX_MODELS_ALLOWLIST =
     'llama3.1-70b,arctic-translate,arctic-extract,arctic-sentiment,arctic-parse-document,arctic-extract-answer,arctic-summarize';
   

   Copy

Alternatively, use model RBAC by setting CORTEX_MODELS_ALLOWLIST = 'None' and granting model application roles (for example, SNOWFLAKE."CORTEX-MODEL-ROLE-ARCTIC-TRANSLATE") to the appropriate roles.

This change is being made to:

• Maintain consistent governance

• Enforce least-privilege access uniformly

• Align managed AI Functions with existing Cortex model access controls

• Strengthen enterprise-grade compliance guarantees

• Provide transparent model authorization behavior

Ref: 2220