Snowflake Security and Governance Fundamentals
The governance model in one picture
Snowflake security rests on the separation of the control plane (Snowflake-managed metadata services that handle authentication, query parsing, and access decisions) from the data plane (compute and storage in the customer's cloud region). Understanding this split explains why account-level objects and policies behave the way they do.
Key concepts to master: the role hierarchy (SYSADMIN, SECURITYADMIN, ACCOUNTADMIN, USERADMIN, PUBLIC) and the principle that privileges flow down, never up; ownership of objects and the rights that come with it; privileges (USAGE, SELECT, CREATE, OWNERSHIP, etc.) versus future grants; and governance features - object tagging, tag-based masking, data classification, access history, and policy objects (masking, row access, projection, aggregation, session).
Traps candidates fall into
- Assuming ACCOUNTADMIN is a good day-to-day role. Questions reward least privilege and custom functional roles layered under SYSADMIN.
- Confusing future grants with existing grants - they only apply to objects created after the grant.
- Forgetting that a masking or row access policy is enforced based on the role in the session, not the user's default role.
- Mixing up tag-based masking (a tag drives the policy) with a directly attached policy.
- Believing ownership transfers automatically when a role is dropped; owned objects need reassignment first.
Rule of thumb
Build custom roles for functions (e.g., analyst_role), grant them to users, and grant object privileges to those roles - reserve ACCOUNTADMIN for account administration and never for querying data. If a question offers "grant ACCOUNTADMIN" as a shortcut, treat it as the wrong answer.
Worked example
A new schema will hold tables analysts must read. Grant USAGE on the database and schema to analyst_role, grant SELECT on existing tables, and add GRANT SELECT ON FUTURE TABLES IN SCHEMA ... TO ROLE analyst_role so tables created later are covered automatically.