PingOne Privilege

Configuring Snowflake Cortex

Connect Snowflake Cortex as a workload agent application so AI discovery for workload agents can review the agents and MCP servers running in the account. Learn more in Discover and manage workload agents.

  1. In the PingOne Privilege admin console, go to AI Security > Workload Agents.

  2. Click the Add Application tab.

  3. In the list of available applications, find Snowflake Cortex and click Integrate.

  4. Enter a Name for the connection.

  5. (Optional) Enter a Description.

  6. Click Next.

  7. Create a dedicated Snowflake service user and role with the following required privileges:

    • SHOW AGENTS IN ACCOUNT

    • SHOW MCP SERVERS IN ACCOUNT

    • SHOW GRANTS ON AGENT <db>.<schema>.<name>

    • SHOW GRANTS ON MCP SERVER <db>.<schema>.<name>

    • SHOW GRANTS TO ROLE <role>

    • DESCRIBE AGENT <db>.<schema>.<name>

    • DESCRIBE MCP SERVER <db>.<schema>.<name>

    • USAGE ON WAREHOUSE

    • ALTER AGENT <fqn> SET COMMENT = $$<text>$$

    • ALTER MCP SERVER <fqn> SET COMMENT = $$<text>$$

    • DROP AGENT <fqn>

    • DROP MCP SERVER <fqn>

    • REVOKE USAGE ON AGENT <fqn> FROM ROLE PUBLIC

    • REVOKE USAGE ON AGENT <fqn> FROM ROLE <role>

    • REVOKE USAGE ON MCP SERVER <fqn> FROM ROLE PUBLIC

    • REVOKE USAGE ON MCP SERVER <fqn> FROM ROLE <role>

    • GRANT USAGE ON AGENT <fqn> TO ROLE <role>

    • GRANT USAGE ON MCP SERVER <fqn> TO ROLE <role>

    • GRANT OWNERSHIP ON AGENT <fqn> TO ROLE <role> REVOKE CURRENT GRANTS

    • GRANT OWNERSHIP ON MCP SERVER <fqn> TO ROLE <role> REVOKE CURRENT GRANTS

  8. When you’re done creating the Snowflake service user, click Next.

  9. Use the org-account format to enter an Account Identifier.

  10. Enter a PingOne Privilege User.

  11. Generate your RSA Private Key (PEM) with the following command:

    $ openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out rsa_key.pem

  12. Paste the key into the required field in the wizard.

  13. (Optional) Enter a Warehouse. Leave empty for user default.

  14. (Optional) Enter a Default Database. Leave empty to scan all databases.

  15. Click Next.

  16. Review the summary, then click Add Connection.

You can now validate that the connection is active in the Active Applications tab.