User Access#

Access to the RelationalAI (RAI) Native App is managed through Snowflake’s role-based access control system. The app provides a set of application roles that can be granted to users for access to the application’s resources.

Grant Application Roles#

Application roles are not granted directly to users. Instead, application roles are granted to database roles, and users are granted those database roles.

There are three types of application roles:

• Service roles are required for general app management and usage.
• Resource roles are required to view and manage all app resources.
• RAI schema-specific roles provide access to specific RAI schemas and their resources.

Use the GRANT APPLICATION ROLE command to grant an application role to a database role:

#-- Example: User with full admin access to the entire app.
GRANT APPLICATION ROLE relationalai.all_admin TO ROLE <db_role>;

-- Example: User with limited service and resource access,
-- but full access to the RAI schema named <schema>.
GRANT APPLICATION ROLE relationalai.app_user TO ROLE <db_role>;
GRANT APPLICATION ROLE relationalai.eng_user TO ROLE <db_role>;
GRANT APPLICATION ROLE relationalai.<schema>_all TO ROLE <db_role>;

Refer to the List of Application Roles for the full list of available roles.

Revoke Application Roles#

Use REVOKE APPLICATION ROLE to revoke an application role from a database role:

#REVOKE APPLICATION ROLE relationalai.<role_name> FROM ROLE <database_role_name>;

Delegate User Access Management#

App owners may delegate user access management to other users by granting them access to stored procedures that grant and revoke application roles.

For example, to create a stored procedure that grants the all_admin application role to a user:

#CREATE PROCEDURE <snowflake_db_name>.GRANT_APP_ADMIN(target_role STRING)
RETURNS STRING
LANGUAGE SQL
EXECUTE AS OWNER
AS
BEGIN
    LET q STRING := 'GRANT APPLICATION ROLE relationalai.app_admin TO ROLE ' || :TARGET_ROLE;
    EXECUTE IMMEDIATE :q;
    RETURN 'ok';
END;

Use a similar delegation pattern to revoke access to application roles.

List of Application Roles#

Service Application Roles#

Service roles provide access to the RAI Native App itself, billing information, and logs.

Resource Application Roles#

Resource roles provide access to all of the RAI Native App’s resources.

RAI Schema-Specific Application Roles#

Schema-specific roles provide access to specific RAI schemas and their resources and are prefixed with the schema name.