Apono Agent Privilege Guard for Snowflake (BETA)
Configure governed, just-in-time AI access to a Snowflake instance
The Snowflake MCP is currently in Beta. Contact your Apono representative for setup information.
Set up Apono Agent Privilege Guard for Snowflake to give AI agents controlled, temporary access to your Snowflake instance.
An Apono admin configures the Snowflake integration, an agentic access flow, and the Snowflake MCP. Each user then connects a supported AI client through the Local Agentic Gateway, which brokers requests between the AI client, Apono, and Snowflake.
Set up the Apono account
An Apono admin completes this setup once.
After the Apono account setup is complete, each user can connect a supported AI client to the Agentic Gateway.
Prerequisites
Snowflake integration
Connected Apono integration
Verify that the integration exists and is healthy on the Connected tab. If no Snowflake integration is connected, follow the Snowflake integration docs.
Apono connector permission
Required connector permissions
Connector used by the Snowflake integration must be deployed with permissions to create users.
Create an agentic access flow
Create a Self Serve access flow that allows agents to request temporary access to a Snowflake instance on behalf of permitted users:
Follow the procedure in Self Serve Access Flows to define the requestors, resources, access duration, and approval process. As you create the flow, apply the following settings for agentic access.
Access Flow Name
Enter a unique, user-friendly name, such as Agentic - Snowflake.
When Requestor
Select the users or groups on whose behalf an agent can request access. The agent can request access only on behalf of its associated user, so that user must match these requester conditions. For Can request for, select Themselves.
Request access to
Select your Snowflake integration, and then select the resource types, resources, and permissions the agent can access.
Follow the Integrations instructions in the Define the resource section of the Self Serve Access Flows guide. NOTE: Prefer narrowly scoped, read-oriented roles. Grant broader roles only when required for the agent’s intended tasks.
Grant for
Set the access duration to 5 minutes.
Approval
Select Automatic
Settings
Click the Restrict to agentic access toggle to enable the setting.
Allow Extend Duration does not apply to agentic access flows. When access expires, the agent requests access again.
Configure any other Self Serve access flow settings according to your organization’s access policies.
Click Save Access Flow.
Enable MCP features and the Snowflake MCP
Follow these steps:
On the Account Settings page, under AI & Automation, click the Enable MCP features toggle to enable the setting. The toggle turns green.
On the MCPs tab, under Apono Managed Tools, click the toggle on the Snmowflake MCP card to enable the tool.
Learn more about Model Context Protocol servers.
After setup, use the AI Agents tab to view discovered agents and their associated users. Use the AI Sessions tab to review agent activity, including access grants, tool calls, and intent policy decisions.
Set up the Agentic Gateway on a local machine
Each user running the gateway completes this setup on their local machine.
Prerequisites
Apono account setup completed
Enablement of MCP feature for the Apono account
Confirm that an Apono admin has set up the Apono Account:
Connected the applicable integration
Created an agentic access flow with Restrict to agentic access enabled
Enabled MCP features and the Snowflake MCP
macOS
Supported operating system
The Local Agentic Gateway is currently supported on macOS.
Node.js 20+
Required runtime
The gateway is launched with npx, which runs @apono-io/apono-mcp@latest, downloads the gateway binary, and manages the Apono sign-in. No separate Apono CLI installation is required.
Configure your AI client
If the Agentic Gateway is already configured for this client, skip to Verify your agent.
Follow these steps:
Run the following command. If this is the first run, a separate browser tab opens.
(First run only) Log in to Apono in the open browser tab.
Follow these steps:
In Claude, from the main navigation, click Claude > Settings > Developer. The Settings page appears.
Click Edit Config. The claude_desktop_config.json file opens.
Add the following configuration.
Save the file.
Quit and restart Claude desktop.
(First run only) Log in to Apono in the browser tab that opens.
Follow these steps:
In Cursor, from the main navigation, click Tools & MCPs. The Tools page appears.
Under Home MCP Servers, click New MCP Server. The mcp.json file opens.
Add the following configuration.
Save the file.
Quit and restart Cursor.
(First run only) Log in to Apono in the browser tab that opens.
Verify your agent
Perform the following tests:
Ask the assistant to list your available integrations. The Snowflake target should appear.
Ask it to perform an action, such as "Request all databases in Snowflake". The agent will request access through the agentic access flow.
Apono handles Snowflake authentication for you. Once the request is approved, it fetches short-lived credentials and wires up the connection automatically. The call should return live Snowflake data.
If either task fails, troubleshoot your setup.
Troubleshooting
Apono Account
Access is granted, but Snowflake grants fail.
The connector backing the Snowflake integration likely does not have the grants required by the Snowflake integration.
Local Machine
No targets or integrations are listed.
Follow these steps:
Reauthenticate to Apono.
Fully restart the AI client so the updated credentials take effect.
If the target is still unavailable, confirm with an Apono admin that the platform setup is complete. This includes the integration, agentic access flow, MCP feature enablement, and applicable Apono Managed MCP.
Follow the troubleshooting instructions in the applicable platform setup guide.
Writes are blocked or awaiting approval.
By default, every Update/Create/Delete action waits for your approval, and Admin actions are denied. Ask your admin to adjust the Snowflake MCP's Intent Policy if needed.
Last updated
Was this helpful?