Your AI agents are about to have more access to your enterprise data than most of your engineers. Snowflake knows this, and at Black Hat 2026 the company shipped a control plane to do something about it. Cortex AI Gateway is a centralized governance layer that sits between AI agents and the models, data, MCP servers, and tools those agents want to touch. It supports more than 100 MCP servers and governs both Snowflake-native agents like CoCo and CoWork and third-party tools like Claude Code, Cursor, Amazon Bedrock, and custom LangChain apps. The catch: the gateway itself is heading to public preview soon, and most of its marquee features, including cost control, intelligent model routing, and observability, are still in private preview.
The timing is not accidental. AI security concerns surged from 17 percent of organizations in 2024 to 48 percent in 2026, according to The Linux Foundation's 2026 State of Tech Talent Report, as cited by Snowflake. Meanwhile 97 percent of organizations say they are committed to implementing AI, and 57 percent face a significant capacity gap in security and risk management. The gap between adoption and security is where data exfiltration, tool hijacking, and runaway token costs live.
If you own a Snowflake bill or govern data access in a Snowflake environment, this is the feature set that determines whether you let agents into production or keep them in sandboxes. Here is what shipped, what is real, and what you should do about it.
What shipped at Black Hat 2026 and what is still private preview?
Snowflake announced a bundle of features, but they are not all at the same maturity. Sorting them by availability tells you what you can put in a production architecture today versus what is still a roadmap promise.
Generally available now:
- Agent Identity: Security and governance teams can enforce data access policies that apply specifically when an agent is in the session, even if the agent runs on behalf of a privileged user. Snowflake added dedicated agent identity tracking in ACCOUNT_USAGE views for auditing.
- Native AI Security Posture Management: Integrated into the Trust Center, this gives security operations a dashboard to scan for AI-specific configuration risks, assess compliance against emerging regulations, and deploy programmatic remediations.
- Data movement policies: Strict policies that govern where data can move, now GA, pairing with the preview DXP package for enforcement.
- Ransomware Protection via Multi-Party Approval: Requires two or more authorizations before any destructive system change can proceed.
In preview or coming soon:
- Cortex AI Gateway: Public preview soon. The overall gateway for agent access, cost, and audit.
- Data Exfiltration Prevention (DXP): Preview, via the Trust Center.
- Restricted Session Scope: GA soon. Limits agent sessions to only what a task requires.
Private preview (request access, no public docs):
Wide Model Catalog, Access Governance and Sprawl Control, Govern Every Agent Connection, Observability and Tracing, Agent Action Auditability, AI Cost Control, Intelligent Model Routing, Context-Aware Access Policies, and CoCo CLI VM Sandbox.
The chart below shows the breakdown: 4 features are GA, 3 are in some preview stage, and 9 are in private preview. If you are planning an architecture around this, most of the value is still behind a door you have to knock on.
How does the gateway govern MCP server access?
MCP, the Model Context Protocol, has become the standard for connecting LLMs to databases, internal tools, and SaaS environments. The problem is that every team that adopts MCP does it differently, with no central visibility. Snowflake's answer is to put a gateway in front of all of it.
Cortex AI Gateway integrates Natoma, the MCP gateway company Snowflake acquired in May 2026, directly into the platform. Natoma enforced identity, policy, and audit at the tool-call level. Now that enforcement lives inside Snowflake's governance framework.
The gateway sits between agents and the things they want to reach. An agent, whether it is CoCo running inside Snowflake or Claude Code running on a developer laptop, makes a request to call a tool or access a model. The gateway checks three things: who requested the action, what permissions they have, and whether the action is allowed. If the answer is yes, the call proceeds and is logged. If no, the call is blocked.
For first-party agents, this is native. For third-party agents, Snowflake announced integrations with 1Password, Aembit, Cyera, Linx Security, Okta, SailPoint, and Saviynt to extend the same identity framework outward. A governance policy you write for a Snowflake-native agent also covers a Claude Code session hitting your data.
The access control model uses Snowflake's standard privilege framework. A simplified grant for gateway-managed tool access:
-- Grant a role access to a gateway-managed MCP integration
-- (exact object type will be documented at public preview)
GRANT USAGE ON INTEGRATION my_mcp_integration
TO ROLE agent_operator_role;
-- Grant access to Cortex AI functions (standard Snowflake pattern)
GRANT USAGE ON DATABASE SNOWFLAKE TO ROLE agent_operator_role;
GRANT USAGE ON SCHEMA SNOWFLAKE.CORTEX TO ROLE agent_operator_role;The exact privilege names and object types for the gateway are not yet publicly documented since the feature is in preview. What you should take away is that agent access will be governed by roles and grants you control, not by API keys scattered across developer machines.
What can you actually enforce with agent identity?
Agent Identity is GA, and it is the feature you can use today. The core idea: when an agent is in a session, Snowflake knows it is an agent, not a human user, and can enforce policies accordingly.
This matters because agents often run under privileged roles. A data scientist with SYSADMIN privileges kicks off an agent to analyze a table. Without agent identity, that agent has the full power of the role. With agent identity, you can write policies that restrict access to sensitive columns, block DDL, or limit the session to read-only when an agent is the actor.
| Scenario | Without Agent Identity | With Agent Identity (GA) |
|---|---|---|
| Agent runs under SYSADMIN | Full admin access to all objects | Policies restrict agent to task scope |
| Auditing who did what | Query shows the human user | Query shows agent identity and human user |
| Sensitive column access | Agent sees everything the role allows | Masking policies can trigger on agent context |
| Destructive actions | Agent can drop tables if role allows | Restricted Session Scope (GA soon) blocks this |
You can audit agent activity through ACCOUNT_USAGE views. A query to find agent-driven access to sensitive tables:
-- Identify queries executed in the last 24 hours
-- Agent identity columns are new in GA; filter for agent sessions
SELECT
query_id,
query_text,
user_name,
role_name,
start_time,
execution_status
FROM SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY
WHERE start_time >= DATEADD('day', -1, CURRENT_TIMESTAMP())
AND query_type IN ('SELECT', 'INSERT', 'UPDATE', 'DELETE')
ORDER BY start_time DESC
LIMIT 100;With Agent Identity GA, Snowflake has added agent-specific tracking to these views. The exact column names depend on your Snowflake version, but the capability means you can filter for queries where an agent was the actor, not just the human who started the session. This is the audit trail your security team needs when someone asks which agent touched the customer table.
Restricted Session Scope is the companion feature, marked GA soon. It limits what an agent session can do to only what the task requires. A read-only analysis stays read-only, even if the user's role normally allows INSERT or DELETE. This is the principle of least privilege applied to agent sessions, and it is the feature that makes running agents under privileged roles defensible.
How does the cost control layer work?
This is the section that matters if you own the bill. AI Cost Control, in private preview, gives you a unified view of AI consumption by team, agent, or workload. You can set budget guardrails and route requests to cheaper models for simpler tasks.
Intelligent Model Routing, also private preview, automatically routes agent requests to the right model based on cost, latency, capability, and data residency. If a simple summarization task does not need the most expensive model, the gateway can route it to a cheaper one. If a task requires reasoning, it goes to the stronger model. The gateway also enforces data residency: requests stay in the region they need to stay in.
The cost model for the gateway itself is not yet published. Snowflake has not announced specific credit pricing for Cortex AI Gateway in the source material. What is clear is that the feature is designed to control AI consumption costs: the token spend across external model providers like OpenAI, Anthropic, and Google, not the Snowflake compute credits you already track. If your team is spending on external model APIs through Snowflake, the gateway is the layer that puts guardrails around that spend.
For a parallel on how Snowflake thinks about cost control, see our guide on Snowflake Adaptive Compute costs. The same philosophy of applying guardrails before the bill runs away now extends to AI token consumption.
What you would do: if you are in the private preview, set per-agent budget caps immediately. If you are not, start instrumenting your current agent workloads with ACCOUNT_USAGE queries to establish a baseline of what agents are actually costing you today.
What does data exfiltration prevention actually block?
The Data Exfiltration Prevention (DXP) package is in preview via the Trust Center. It pairs real-time telemetry with the now-GA data movement policies to detect and intercept unauthorized data flows before they exit the ecosystem.
The platform can proactively flag and block three specific patterns:
- Sensitive data fetches triggered by AI agents: An agent queries a table with PII or financial data, and the system flags or blocks the retrieval based on policy.
- Unauthorized data routing to internal or external stages: Data moves to a storage location that is not approved, and the movement is intercepted.
- Mass data downloads via user interfaces: A user or agent attempts to export a large volume of data through the UI, and the download is blocked.
The underlying data movement policies are GA, meaning you can author and enforce them now. The DXP package adds the real-time telemetry and detection layer on top. A basic network policy in Snowflake:
-- Create a network policy to restrict allowed IP ranges
CREATE NETWORK POLICY corp_allowed_egress
ALLOWED_IP_LIST = ('10.0.0.0/8')
COMMENT = 'Restrict data movement to corporate network';
-- Apply the network policy at the account level
ALTER ACCOUNT SET NETWORK_POLICY = corp_allowed_egress;This is not a new concept if you already use Snowflake network policies. What is new is the pairing with AI-specific telemetry: the system can distinguish between a human user downloading a CSV and an agent triggering a bulk data fetch, and apply different rules to each.
Should you build on this today or wait?
Here is the honest read. If you are deciding whether to architect around Cortex AI Gateway right now, the answer depends on what you need.
Build on what is GA today:
- Agent Identity for auditing and policy enforcement on agent sessions.
- AI Security Posture Management in the Trust Center for scanning configuration risks.
- Data movement policies for controlling where data goes.
- Multi-Party Approval for protecting destructive operations.
Request private preview for:
- The gateway itself, if you have MCP sprawl and need centralized access control across more than 100 MCP servers.
- AI Cost Control, if your token spend is growing and you need budget guardrails.
- Intelligent Model Routing, if you are using multiple model providers and want automatic selection.
Wait on:
- Context-Aware Access Policies (private preview) if you already have network policies and row access policies that work. The zero-trust evaluation of identity, network, and client context in a single expression is promising but unproven at scale.
- CoCo CLI VM Sandbox (private preview, macOS only) unless you have a specific need for kernel-level isolation of agent development environments.
The lock-in question is real. Cortex AI Gateway is built on Natoma, which Snowflake acquired. If you build your agent governance around this gateway, you are building around Snowflake's control plane. For organizations already deep in Snowflake, that is a reasonable trade. For teams running multi-cloud or multi-platform agent architectures, the gateway covers a wide catalog of MCP servers but the governance model is Snowflake-centric.
If you want to start with something concrete, our guide to building an AI agent on your Snowflake data with Cortex Agents covers the agent side. Pair that with Agent Identity (GA) and data movement policies (GA), and you have a defensible production architecture for agent access today, even without the full gateway.
The trust boundary moved inside Snowflake
The important shift here is architectural. Agent governance used to be an application-layer problem: you built guardrails into your LangChain app, your MCP client, or your agent framework. Snowflake is arguing that security belongs in the data and control planes rather than bolted onto the application. Cortex AI Gateway, Agent Identity, and DXP move the trust boundary inside Snowflake itself.
That argument is sound if your data lives in Snowflake. The features that are GA today, Agent Identity and data movement policies, are enough to start governing agent access in production. The features that are still in private preview, cost control, model routing, and observability, are the ones that will make the gateway worth the architectural commitment. Watch for the public preview transition. That is when you will know whether the gateway delivers on the promise or stays a roadmap item.
Sources
- Snowflake Blog - Enterprise AI Security: Agentic Controls and MCP Governance
- VentureBeat - Snowflake launches Cortex AI Gateway to control AI agents and prevent runaway enterprise costs
- SiliconANGLE - Snowflake debuts Cortex AI Gateway to govern and monitor enterprise AI agents
- Yahoo Finance / Business Wire - Snowflake Advances the Trusted Agentic Enterprise Era with Unified Monitoring and Cost Management
