---
title: Configuring Snowflake Cortex
description: Connect PingOne Privilege to Snowflake Cortex so AI discovery can review its agent inventory.
component: privilege
page_id: privilege:agent-privilege:configuration/workload-agent-apps/snowflake-cortex
canonical_url: https://docs.pingidentity.com/privilege/agent-privilege/configuration/workload-agent-apps/snowflake-cortex.html
llms_txt: https://docs.pingidentity.com/privilege/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: October 21, 2026
---

# Configuring Snowflake Cortex

Connect Snowflake Cortex as a workload agent application so AI discovery for workload agents can review the agents and MCP servers running in the account. Learn more in [Discover and manage workload agents](../../use-cases/workload-agents.html).

1. In the PingOne Privilege admin console, go to **AI Security > Workload Agents**.

2. Click the **Add Application** tab.

3. In the list of available applications, find **Snowflake Cortex** and click **[icon: plus, set=fa]Integrate**.

4. Enter a **Name** for the connection.

5. (Optional) Enter a **Description**.

6. Click **Next**.

7. Create a dedicated Snowflake service user and role with the following required privileges:

   * `SHOW AGENTS IN ACCOUNT`

   * `SHOW MCP SERVERS IN ACCOUNT`

   * `SHOW GRANTS ON AGENT <db>.<schema>.<name>`

   * `SHOW GRANTS ON MCP SERVER <db>.<schema>.<name>`

   * `SHOW GRANTS TO ROLE <role>`

   * `DESCRIBE AGENT <db>.<schema>.<name>`

   * `DESCRIBE MCP SERVER <db>.<schema>.<name>`

   * `USAGE ON WAREHOUSE`

   * `ALTER AGENT <fqn> SET COMMENT = $$<text>$$`

   * `ALTER MCP SERVER <fqn> SET COMMENT = $$<text>$$`

   * `DROP AGENT <fqn>`

   * `DROP MCP SERVER <fqn>`

   * `REVOKE USAGE ON AGENT <fqn> FROM ROLE PUBLIC`

   * `REVOKE USAGE ON AGENT <fqn> FROM ROLE <role>`

   * `REVOKE USAGE ON MCP SERVER <fqn> FROM ROLE PUBLIC`

   * `REVOKE USAGE ON MCP SERVER <fqn> FROM ROLE <role>`

   * `GRANT USAGE ON AGENT <fqn> TO ROLE <role>`

   * `GRANT USAGE ON MCP SERVER <fqn> TO ROLE <role>`

   * `GRANT OWNERSHIP ON AGENT <fqn> TO ROLE <role> REVOKE CURRENT GRANTS`

   * `GRANT OWNERSHIP ON MCP SERVER <fqn> TO ROLE <role> REVOKE CURRENT GRANTS`

8. When you're done creating the Snowflake service user, click **Next**.

9. Use the `org-account` format to enter an **Account Identifier**.

10. Enter a PingOne Privilege **User**.

11. Generate your **RSA Private Key (PEM)** with the following command:

    ```bash
    $ openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out rsa_key.pem
    ```

12. Paste the key into the required field in the wizard.

13. (Optional) Enter a **Warehouse**. Leave empty for user default.

14. (Optional) Enter a **Default Database**. Leave empty to scan all databases.

15. Click **Next**.

16. Review the summary, then click **Add Connection**.

You can now validate that the connection is active in the **Active Applications** tab.