10.15 Release Notes: Apr 24, 2026-May 2, 2026¶

Programmatic access tokens: role restrictions and blocked roles¶

Authentication policies for programmatic access tokens now support two new capabilities: requiring role restrictions for person users, and blocking specific roles from being used as token restrictions.

Previously, role restrictions could only be enforced or lifted for service users. The new PAT_POLICY properties provide finer control:

• REQUIRE_ROLE_RESTRICTION_FOR_PERSON_USERS: when set to TRUE, person users (TYPE=PERSON or TYPE=NULL) must specify a role when generating a programmatic access token. The default is FALSE.

• BLOCKED_ROLES_LIST: prevents specified roles (for example, ACCOUNTADMIN or SYSADMIN) from being used as the role restriction for any programmatic access token. Blocking a role also invalidates existing tokens restricted to that role.

For more information, see Configuring role restrictions for programmatic access tokens.

COUNT with DISTINCT in window functions (General availability)¶

With this release, you can use COUNT with DISTINCT in a window function when the OVER clause includes ORDER BY, provided DISTINCT applies to a single column expression. A distinct count that references multiple column expressions in the window function is still not valid when OVER also specifies ORDER BY.

For more information, see COUNT.

New ACCOUNT_USAGE.TASKS view¶

The ACCOUNT_USAGE schema now includes a new TASKS view. The view displays a row for each task defined in your account, including columns for schedule, definition, state, predecessor tasks, task relationships, and other properties.

For more information, see TASKS view.