Snowflake Native Apps: Bootstrap core Snowflake capabilities to native applications (Pending)

Starting October 1, 2026, Snowflake enables a selected set of public Snowflake capabilities for both installed Snowflake Native Apps and new native applications. An application inherits these capabilities through SNOWFLAKE.APP_PUBLIC, a Snowflake-managed application role that is automatically activated whenever the application runs.

This enhancement reduces the friction of installing and configuring native applications that access a common, core set of Snowflake features, such as system metadata and viewer functions, package repositories, data quality functions, AI functions, and feature-specific application roles. It also unblocks the setup script to use those capabilities directly during installation.

Account-level PUBLIC behavior is unchanged. This change applies to native applications only.

Important

All information in this notice, including the planned date, is subject to change. Snowflake enables these capabilities progressively, so the date on which a given account sees the change can vary.

Behavior change

Before the change:

An application has access to a public Snowflake capability only if it receives the corresponding account privilege or SNOWFLAKE database role. SNOWFLAKE application roles aren’t available to native applications. Account privileges must also be requested in the application manifest and granted by the consumer. An application that doesn’t receive the grant can’t use the corresponding feature.

After the change:

An installed application inherits the capabilities listed in Enabled capabilities through SNOWFLAKE.APP_PUBLIC, with no request in the manifest and no grant from the consumer. SNOWFLAKE.APP_PUBLIC is automatically active whenever an application runs, and consumers can’t revoke it or the capabilities granted through it.

Grants to the account-level PUBLIC role, and the account-level controls that govern them, work exactly as they do today.

Enabled capabilities

The following tables describe the access that SNOWFLAKE.APP_PUBLIC conveys to an application. A grant in these tables doesn’t replace the other object, data, warehouse, or service privileges that an application needs for a broader workflow. For example, an app that receives CORTEX_USER still needs a warehouse and access to the data it processes.

To view the capabilities currently granted to SNOWFLAKE.APP_PUBLIC, run:

SHOW GRANTS TO APPLICATION ROLE SNOWFLAKE.APP_PUBLIC;

Account privileges

CapabilityWhat it enables for a Snowflake Native App
BIND SERVICE ENDPOINTBinds a public ingress endpoint to a Snowpark Container Services service. It doesn’t by itself allow service creation.
EXECUTE AGENT TASKExecutes an agent task. It doesn’t by itself create or schedule agent tasks.
MANAGE ARTIFACT PUBLICATIONPublishes and unpublishes supported artifacts, such as dashboards to Snowflake CoWork.
USE AI FUNCTIONSPermits AI function calls.
VIEW LINEAGEViews upstream and downstream lineage for objects that the app can already access.

Database roles

CapabilityWhat it enables for a Snowflake Native App
ALERT_VIEWERUses alert system functions in the SNOWFLAKE.ALERT schema.
ANACONDA_REPOSITORY_USERUses the shared Anaconda package repository, so that Python UDFs and procedures can reference packages from it.
CLASSIFICATION_VIEWERUses SNOWFLAKE.DATA_PRIVACY and instantiates the CUSTOM_CLASSIFIER and CLASSIFICATION_PROFILE classes.
COPILOT_USERAccesses Snowflake Copilot features.
CORE_VIEWERUses system functions and bundles in the SNOWFLAKE.CORE schema.
CORTEX_USERUses Snowflake Cortex AI functions and the Cortex Agents API.
DATA_METRIC_USERUses Snowflake system data metric functions (DMFs).
DATA_PRIVACY_VIEWERReads the SNOWFLAKE.DATA_PRIVACY generalization views, including age and US postal hierarchies.
ML_USERUses Snowflake ML functions in SNOWFLAKE.ML, including forecasting and anomaly detection functions.
NOTIFICATION_VIEWERUses the SNOWFLAKE.NOTIFICATION schema and notification configuration helper functions to read notification integration metadata.
PYPI_REPOSITORY_USERUses the shared PyPI package repository, so that Python UDFs and procedures can reference packages from it.
SPCS_VIEWERUses the SNOWFLAKE.SPCS schema and the GET_JOB_HISTORY function to read Snowpark Container Services job history.

Application roles

CapabilityWhat it enables for a Snowflake Native App
APP_DEVELOPERUses the SNOWFLAKE.APPS schema and SAR app area system functions.
CLASSIFICATION_PROFILE_VIEWERUses the local schema and receives read-only access to the two default classification profiles.
CORTEX-MODEL-ROLE-ALLUses the models schema and all Cortex base models. This role is already granted to SNOWFLAKE.APP_PUBLIC.
DATA_QUALITY_MONITORING_LOOKUPUses the local schema and the data quality monitoring and anomaly detection result lookup functions.
OOB_CORTEX_EXTENSION_TAG_APPLYApplies the TAGS.CORTEX_EXTENSION_CATEGORIES tag.
OOB_TAG_READUsage on the SNOWFLAKE.TAGS schema.
PERFORMANCE_EXPLORER_PUBLIC_USERUses the local schema and the PERFORMANCE_EXPLORER!USER instance role.
PROFILER_USERUses the local schema and reads Python UDF profiler output through GET_PYTHON_UDF_PROFILER_OUTPUT.

What you should do

No action is required to receive the new capabilities.

Providers: After the capabilities are enabled in your consumers’ accounts, an app no longer needs to request the corresponding SNOWFLAKE database role or account privilege in the manifest to use the features in the preceding tables. Keep existing requests in place until the rollout completes in the accounts where your app is installed, then remove them if they’re no longer needed.

Consumers: Review the capabilities in the preceding tables and confirm that the access they convey is acceptable for the applications installed in your account. These capabilities apply to applications only and don’t change what any account role, including PUBLIC, can do. If a capability isn’t acceptable for an application, uninstall the application.

See also

Ref: 2437