Snowflake App Runtime: execution role and caller’s rights for apps in a personal database

Note

This change is rolled out gradually between July 20 and July 27, 2026.

The following changes affect a Snowflake App Runtime app created in a personal database.

Important

This change applies to apps created after the rollout reaches your account; apps created before then keep the previous execution behavior. Caller’s rights (RCR) is available only for apps created after the rollout reaches your account. To use caller’s rights with an app created before then, drop and recreate the app.

Before the change:
  • Owner’s rights queries issued by the app ran as the app owner with all of that user’s secondary roles active.
  • Caller’s rights was not supported for apps in a personal database.
After the change:
  • Owner’s rights queries run as a single execution role, controlled by the new EXECUTE_AS_ROLE property on the app.
  • If EXECUTE_AS_ROLE isn’t specified when the app is created, Snowflake sets it to the primary role of the session that creates the app.
  • The role in EXECUTE_AS_ROLE must be granted to the owning role of the app.
  • Caller’s rights is supported for apps in a personal database. Caller’s rights grants are derived through the role in EXECUTE_AS_ROLE.

To see the execution role for an app, run DESCRIBE APPLICATION SERVICE and check the execute_as_role column.

For details, see CREATE APPLICATION SERVICE and Access control for Snowflake App Runtime.

Ref: 3708067