CORTEX_MODELS_ALLOWLIST deprecation and embedding model RBAC enforcement (Pending)¶

Snowflake is converging Cortex model access on model role-based access control (RBAC). The CORTEX_MODELS_ALLOWLIST account parameter is being deprecated, and model RBAC authorization is being enforced for embedding models, including AI_EMBED and Cortex Search. This change rolls out in phases: an unbundled behavior change that deprecates the allowlist and migrates accounts to model RBAC, followed by embedding model RBAC enforcement in the 2026_07 behavior change bundle.

Before the change:

When a Cortex call arrives, Snowflake checks model RBAC first. If the calling role doesn’t have access to the corresponding model object in SNOWFLAKE.MODELS, Snowflake falls back to the CORTEX_MODELS_ALLOWLIST parameter. You can set the allowlist to 'All', 'None', or a comma-separated list of models, and model RBAC isn’t enforced for embedding models.

After the change:

Cortex model access is determined exclusively through model RBAC. CORTEX_MODELS_ALLOWLIST is no longer consulted during authorization, and you can only set it to 'None'. Model RBAC is enforced for embedding models, including AI_EMBED and Cortex Search.

Existing accounts retain access through an automatic backfill of embedding model application roles, and newly created accounts receive access through the automatic CORTEX-MODEL-ROLE-ALL bootstrap grant.

What you need to do¶

If CORTEX_MODELS_ALLOWLIST is already set to 'None' in your account, you’re already using model RBAC exclusively and no action is required.

Otherwise, to ensure uninterrupted access to models after enforcement begins, choose one of the following migration options. For detailed steps, including how to identify affected workloads and grant the equivalent model application roles, see Migrate from the allowlist to RBAC.

• Option 1: Migrate yourself. Configure model access using model RBAC application roles, validate that the configuration provides the required model access, and then set the allowlist to 'None':

  Copy code

  ALTER ACCOUNT SET CORTEX_MODELS_ALLOWLIST = 'None';
  

• Option 2: Wait for Snowflake’s one-time migration. Snowflake maps your existing CORTEX_MODELS_ALLOWLIST configuration to model RBAC application roles between August 17 and September 4, 2026. Validate that the migrated configuration matches your expected model access, and then set the allowlist to 'None'.

While you wait for the Snowflake migration, model RBAC and the allowlist continue to work together, with no change from the current behavior, until the migration begins on August 17, 2026. Test in a non-production account before confirming the migration.

Enforcement through the 2026_07 behavior change bundle¶

Model RBAC enforcement for embedding models is delivered through the 2026_07 behavior change bundle. The bundle follows the standard bundle lifecycle: a default opt-out period beginning around September 8, 2026, followed by a default opt-in period beginning around October 13, 2026, with the rollout completing on November 18, 2026. More detailed documentation accompanies the 2026_07 bundle when it’s published.

Ref: 2378