Cortex Search refresh history: MONITOR privilege grants access (Pending)

Attention

This behavior change is in the 2026_07 bundle.

For the current status of the bundle, refer to Bundle history.

Access to the CORTEX_SEARCH_REFRESH_HISTORY table function is expanding to roles with the MONITOR privilege on a Cortex Search Service. This change provides read-only access to refresh history without requiring the broader OPERATE privilege.

Before the change:

Roles with the OWNERSHIP or OPERATE privilege on a Cortex Search Service could access CORTEX_SEARCH_REFRESH_HISTORY. The MONITOR privilege didn’t grant access.

After the change:

When the 2026_07 behavior change bundle is enabled in your account, roles with the MONITOR, OPERATE, or OWNERSHIP privilege on a Cortex Search Service can access CORTEX_SEARCH_REFRESH_HISTORY. This change is additive: no existing access is revoked.

What you should do

No action is required for roles that already have the OPERATE or OWNERSHIP privilege.

To grant read-only observability access to refresh history without granting the broader OPERATE privilege, grant MONITOR on the Cortex Search Service:

GRANT MONITOR ON CORTEX SEARCH SERVICE <database_name>.<schema_name>.<service_name>
  TO ROLE <role_name>;

To see which roles have privileges on the Cortex Search Service:

SHOW GRANTS ON CORTEX SEARCH SERVICE <database_name>.<schema_name>.<service_name>;

To revoke the MONITOR privilege:

REVOKE MONITOR ON CORTEX SEARCH SERVICE <database_name>.<schema_name>.<service_name>
  FROM ROLE <role_name>;

For information about who can grant privileges, see Access control requirements.

To grant MONITOR automatically on new Cortex Search Services in a schema, use a future grant:

GRANT MONITOR ON FUTURE CORTEX SEARCH SERVICES IN SCHEMA <database_name>.<schema_name>
  TO ROLE <role_name>;

Additional notes

  • MONITOR provides read-only access to refresh history. OPERATE is required to suspend, resume, refresh, or change a Cortex Search Service.
  • MONITOR also grants access to Cortex Search request logs when REQUEST_LOGGING is enabled. Access to CORTEX_SEARCH_REFRESH_HISTORY doesn’t require REQUEST_LOGGING to be enabled.

Ref: 2411