
Cortex AI Gateway: Snowflake's agent governance layer
Cortex AI Gateway is Snowflake's centralized control plane for AI agent access and cost. It governs 100+ MCP servers, but most features are in private preview.
RBAC, masking policies, row access policies, and tags: locking Snowflake down without grinding the data team to a halt.

Cortex AI Gateway is Snowflake's centralized control plane for AI agent access and cost. It governs 100+ MCP servers, but most features are in private preview.
Snowflake tag-based data protection policies entered public preview on July 21, 2026, letting you attach row access, aggregation, projection, and join policies to tags. Objects with the tag auto-inherit the policy, cutting policy attachments from thousands to one per group.
Snowflake workload identity federation is now GA, letting Snowflake act as an OIDC provider so workloads authenticate to external services with short-lived tokens instead of static credentials. It costs zero additional credits and eliminates credential rotation for outbound API calls.
Snowflake access control is role-based: privileges attach to roles, not users. Splitting access roles from functional roles collapses thousands of direct grants to a few hundred, and one masking policy can protect thousands of columns at query time.