LangChain agents on Cortex AI Gateway with MCP tools and traces: code¶

-- LangChain + MCP agent tracing: roles, service user, network policy, warehouse,
-- database.
-- Run as ACCOUNTADMIN (creates a user, a network policy, and grants on the
-- account's AI gateway). Idempotent.

SET cookbook_db   = 'COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING';
SET cookbook_wh   = 'COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING_WH';
SET agent_role    = 'COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING_AGENT';     -- the external agent's identity
SET analyst_role  = 'COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING_ANALYST';   -- reads traces and cost
SET svc_user      = 'COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING_SVC';
SET svc_network_rule   = 'COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING.OBS.COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING_SVC_CLIENTS';
SET svc_network_policy = 'COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING_SVC_POLICY';
SET gateway       = 'SNOWFLAKE';
SET me            = '"' || CURRENT_USER() || '"';

-- Where the agent runs. A service user can only use a programmatic access token
-- while it is subject to a network policy, so the service user gets its own
-- policy allowing this range and nothing else. The default is this session's
-- egress address. If the agent runs on another host, set it to that host's
-- address instead, for example
--   SET client_cidr = '203.0.113.10/32';
SET client_cidr   = CURRENT_IP_ADDRESS() || '/32';

USE ROLE ACCOUNTADMIN;

CREATE DATABASE IF NOT EXISTS IDENTIFIER($cookbook_db);
USE DATABASE IDENTIFIER($cookbook_db);
CREATE SCHEMA IF NOT EXISTS DATA;   -- tables, semantic view, search service, MCP server
CREATE SCHEMA IF NOT EXISTS OBS;    -- cost view for the analyzer

CREATE WAREHOUSE IF NOT EXISTS IDENTIFIER($cookbook_wh)
  WAREHOUSE_SIZE = XSMALL AUTO_SUSPEND = 60 AUTO_RESUME = TRUE INITIALLY_SUSPENDED = TRUE;

CREATE ROLE IF NOT EXISTS IDENTIFIER($agent_role);
CREATE ROLE IF NOT EXISTS IDENTIFIER($analyst_role);

-- AGENT: model inference through the gateway, plus what the MCP tools need.
-- Object grants for the tools are in sql/02, after the objects exist.
GRANT DATABASE ROLE SNOWFLAKE.CORTEX_USER TO ROLE IDENTIFIER($agent_role);
GRANT USAGE ON AI GATEWAY IDENTIFIER($gateway) TO ROLE IDENTIFIER($agent_role);
GRANT USAGE ON WAREHOUSE IDENTIFIER($cookbook_wh) TO ROLE IDENTIFIER($agent_role);
GRANT USAGE ON DATABASE IDENTIFIER($cookbook_db) TO ROLE IDENTIFIER($agent_role);
GRANT USAGE ON SCHEMA DATA TO ROLE IDENTIFIER($agent_role);

-- ANALYST: AGENT_TRACE_TABLE needs MONITOR on the gateway. This role gets
-- MONITOR and no USAGE of its own. It can still send inference while PUBLIC
-- holds USAGE on the gateway (the default, which this recipe leaves in place).
-- Revoke USAGE from PUBLIC to make the split real; see the README.
GRANT MONITOR ON AI GATEWAY IDENTIFIER($gateway) TO ROLE IDENTIFIER($analyst_role);
GRANT USAGE ON WAREHOUSE IDENTIFIER($cookbook_wh) TO ROLE IDENTIFIER($analyst_role);
GRANT USAGE ON DATABASE IDENTIFIER($cookbook_db) TO ROLE IDENTIFIER($analyst_role);
GRANT USAGE ON SCHEMA OBS TO ROLE IDENTIFIER($analyst_role);
GRANT ROLE IDENTIFIER($analyst_role) TO USER IDENTIFIER($me);

-- The agent's identity. The MCP server opens a session with the user's default
-- role and needs a default warehouse, so both are set.
CREATE USER IF NOT EXISTS IDENTIFIER($svc_user)
  TYPE = SERVICE
  DEFAULT_ROLE = $agent_role
  DEFAULT_WAREHOUSE = $cookbook_wh
  COMMENT = 'Cookbook: external LangChain agent identity';
ALTER USER IDENTIFIER($svc_user) SET DEFAULT_ROLE = $agent_role DEFAULT_WAREHOUSE = $cookbook_wh;
GRANT ROLE IDENTIFIER($agent_role) TO USER IDENTIFIER($svc_user);

-- Network policy for the service user only. Stop here unless client_cidr is a
-- single IPv4 address or range from /16 to /32: an IPv6 address, a malformed
-- value, or a broad range such as 0.0.0.0/0 is refused. The account-level
-- network policy, if any, is not touched; a user-level policy takes precedence
-- for this user only.
EXECUTE IMMEDIATE $$
DECLARE
  bad_cidr EXCEPTION (-20002, 'client_cidr must be one IPv4 address or range from /16 to /32, for example 203.0.113.10/32');
  cidr VARCHAR DEFAULT $client_cidr;
BEGIN
  IF (cidr IS NULL OR NOT REGEXP_LIKE(cidr,
      '^((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])[.]){3}(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])/(1[6-9]|2[0-9]|3[0-2])$')) THEN
    RAISE bad_cidr;
  END IF;
  RETURN 'service user network policy will allow ' || cidr;
END;
$$;

CREATE NETWORK RULE IF NOT EXISTS IDENTIFIER($svc_network_rule)
  TYPE = IPV4 MODE = INGRESS VALUE_LIST = ($client_cidr)
  COMMENT = 'Cookbook: addresses the LangChain agent service user may connect from';
ALTER NETWORK RULE IDENTIFIER($svc_network_rule) SET VALUE_LIST = ($client_cidr);   -- a rerun picks up a new address
CREATE NETWORK POLICY IF NOT EXISTS IDENTIFIER($svc_network_policy)
  ALLOWED_NETWORK_RULE_LIST = ($svc_network_rule)
  COMMENT = 'Cookbook: LangChain agent service user only';
ALTER USER IDENTIFIER($svc_user) SET NETWORK_POLICY = $svc_network_policy;

-- Per-user cost for the agent, from the billing view. Traces are best effort and
-- are not a billing source. Owned by ACCOUNTADMIN so the analyst role does not
-- need ACCOUNT_USAGE access; it only sees this service user's rows.
CREATE OR REPLACE VIEW OBS.AGENT_GATEWAY_COST
  COMMENT = 'Cookbook: gateway credits for the agent service user, per request and model'
AS
SELECT h.start_time,
       h.request_id,
       u.name                                          AS user_name,
       c.key::STRING                                   AS model,
       c.value::FLOAT                                  AS credits,
       h.operation_details[c.key]:"input_tokens"::INT  AS input_tokens,
       h.operation_details[c.key]:"output_tokens"::INT AS output_tokens
FROM SNOWFLAKE.ACCOUNT_USAGE.AI_GATEWAY_USAGE_HISTORY h
JOIN SNOWFLAKE.ACCOUNT_USAGE.USERS u ON u.user_id = h.user_id,
LATERAL FLATTEN(input => h.credits_granular) c
WHERE u.name = 'COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING_SVC';
GRANT SELECT ON VIEW OBS.AGENT_GATEWAY_COST TO ROLE IDENTIFIER($analyst_role);

SHOW AI GATEWAYS;
SELECT "name" AS gateway, "base_url", "privatelink_base_url"
FROM TABLE(RESULT_SCAN(LAST_QUERY_ID()));

-- Synthetic marketing data, a semantic view, a Cortex Search service, and a
-- Snowflake-managed MCP server exposing them as tools. Run as ACCOUNTADMIN.
-- Idempotent. Company and campaign names are fictional (Northwind).

SET cookbook_db = 'COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING';
SET cookbook_wh = 'COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING_WH';
SET agent_role  = 'COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING_AGENT';

USE ROLE ACCOUNTADMIN;
USE WAREHOUSE IDENTIFIER($cookbook_wh);
USE DATABASE IDENTIFIER($cookbook_db);
USE SCHEMA DATA;

-- Monthly spend and outcomes for four channels in 2025, generated deterministically.
CREATE OR REPLACE TABLE CAMPAIGN_SPEND (
  channel       VARCHAR,
  month         DATE,
  campaign_name VARCHAR,
  spend         NUMBER(12,2),
  impressions   NUMBER,
  clicks        NUMBER,
  conversions   NUMBER,
  revenue       NUMBER(12,2)
) COMMENT = 'Cookbook: synthetic Northwind marketing spend';

INSERT INTO CAMPAIGN_SPEND
WITH channels (channel, base_spend, cpm, ctr, cvr, aov) AS (
  SELECT * FROM VALUES
    ('Paid Search',  50000, 90.0, 0.030, 0.050, 200.0),
    ('Social Media', 38000, 38.0, 0.010, 0.040, 200.0),
    ('Email',         9500, 44.0, 0.080, 0.070, 100.0),
    ('Display',      27000, 18.5, 0.005, 0.030, 150.0)
),
months AS (
  SELECT DATEADD('month', SEQ4(), '2025-01-01'::DATE) AS month,
         SEQ4() + 1 AS m
  FROM TABLE(GENERATOR(ROWCOUNT => 12))
)
SELECT c.channel,
       mo.month,
       CASE WHEN mo.m <= 3 THEN 'Q1 Brand Awareness'
            WHEN mo.m <= 6 THEN 'Q2 Product Launch'
            WHEN mo.m <= 9 THEN 'H2 Always On'
            ELSE 'Q4 Holiday Push' END                                  AS campaign_name,
       ROUND(c.base_spend * IFF(mo.m >= 10, 1.45, 1 + mo.m * 0.01), 2)  AS spend,
       ROUND(spend / c.cpm * 1000)                                      AS impressions,
       ROUND(impressions * c.ctr)                                       AS clicks,
       ROUND(clicks * c.cvr)                                            AS conversions,
       ROUND(conversions * c.aov, 2)                                    AS revenue
FROM channels c CROSS JOIN months mo;

CREATE OR REPLACE TABLE STRATEGY_DOCS (
  doc_id   VARCHAR,
  title    VARCHAR,
  content  VARCHAR,
  doc_type VARCHAR
) COMMENT = 'Cookbook: synthetic Northwind strategy documents';

INSERT INTO STRATEGY_DOCS VALUES
('DOC-001', 'Channel strategy 2025',
 'Northwind splits its 2025 budget across four channels. Paid Search receives 40 percent for direct response. Social Media receives 25 percent for awareness. Display receives 15 percent for retargeting. Email receives 10 percent and is the most cost-efficient channel. The remaining 10 percent is a flex budget for tests.',
 'strategy'),
('DOC-002', 'Attribution methodology',
 'Revenue is attributed with a multi-touch model and a 30-day lookback. First touch gets 20 percent of the credit, last touch 30 percent, and middle touches share 50 percent by recency. Attributed revenue refreshes daily with a 48-hour lag.',
 'methodology'),
('DOC-003', 'Q4 planning brief',
 'Q4 2025 is the peak period. The Holiday Push campaign runs on all channels from October 1. Targets for Q4: return on ad spend of at least 3.0x across the portfolio and cost per acquisition below 45 dollars.',
 'brief'),
('DOC-004', 'Performance benchmarks',
 'Benchmarks by channel. Paid Search: ROAS 3.0x, conversion rate 5 percent. Social Media: ROAS 1.8x. Email: ROAS 10x, conversion rate 7 percent. Display: ROAS 1.2x. Channels beating benchmark by 20 percent are flagged for more budget.',
 'methodology');

-- Semantic view for Cortex Analyst. CREATE OR ALTER keeps existing grants.
CREATE OR ALTER SEMANTIC VIEW CAMPAIGN_ANALYTICS
  TABLES (
    spend AS COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING.DATA.CAMPAIGN_SPEND
  )
  DIMENSIONS (
    spend.channel       AS channel       COMMENT = 'Marketing channel: Paid Search, Social Media, Email, or Display',
    spend.month         AS month         COMMENT = 'First day of the calendar month',
    spend.campaign_name AS campaign_name COMMENT = 'Campaign name'
  )
  METRICS (
    spend.total_spend       AS SUM(spend)       COMMENT = 'Total spend in USD',
    spend.total_revenue     AS SUM(revenue)     COMMENT = 'Total attributed revenue in USD',
    spend.total_conversions AS SUM(conversions) COMMENT = 'Total conversions',
    spend.roas              AS SUM(revenue) / NULLIF(SUM(spend), 0)     COMMENT = 'Return on ad spend: revenue divided by spend',
    spend.cpa               AS SUM(spend) / NULLIF(SUM(conversions), 0) COMMENT = 'Cost per acquisition in USD'
  )
  COMMENT = 'Cookbook: Northwind campaign performance';

-- Cortex Search over the strategy documents.
CREATE OR REPLACE CORTEX SEARCH SERVICE STRATEGY_SEARCH
  ON content
  ATTRIBUTES doc_type
  WAREHOUSE = COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING_WH
  TARGET_LAG = '1 day'
AS SELECT doc_id, title, content, doc_type FROM STRATEGY_DOCS;

-- MCP server. The tool identifiers and warehouse are literals inside the spec,
-- which is why the recipe's object names are fixed.
-- execute_sql is read-only and runs as the caller, whose role can SELECT only the
-- two tables below.
CREATE OR REPLACE MCP SERVER MARKETING_MCP FROM SPECIFICATION $$
tools:
  - name: query_campaigns
    title: Campaign analytics
    type: CORTEX_ANALYST_MESSAGE
    identifier: COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING.DATA.CAMPAIGN_ANALYTICS
    description: >-
      Turns a question about Northwind campaign spend, revenue, conversions, ROAS
      or CPA into SQL. Returns the SQL; run it with execute_sql to get rows.
  - name: search_strategy_docs
    title: Strategy documents
    type: CORTEX_SEARCH_SERVICE_QUERY
    identifier: COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING.DATA.STRATEGY_SEARCH
    description: Searches Northwind strategy, attribution, planning and benchmark documents.
  - name: execute_sql
    title: Run read-only SQL
    type: SYSTEM_EXECUTE_SQL
    description: Runs a read-only SQL query, such as one returned by query_campaigns, and returns rows.
    config:
      read_only: true
      query_timeout: 60
      warehouse: COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING_WH
$$;

-- CREATE OR REPLACE drops every grant on the replaced objects: grant again, every run.
GRANT USAGE  ON MCP SERVER MARKETING_MCP             TO ROLE IDENTIFIER($agent_role);
GRANT USAGE  ON CORTEX SEARCH SERVICE STRATEGY_SEARCH TO ROLE IDENTIFIER($agent_role);
GRANT SELECT ON SEMANTIC VIEW CAMPAIGN_ANALYTICS     TO ROLE IDENTIFIER($agent_role);
GRANT SELECT ON TABLE CAMPAIGN_SPEND                 TO ROLE IDENTIFIER($agent_role);
GRANT SELECT ON TABLE STRATEGY_DOCS                  TO ROLE IDENTIFIER($agent_role);

SHOW GRANTS TO ROLE IDENTIFIER($agent_role);
SELECT channel, ROUND(SUM(revenue) / SUM(spend), 2) AS roas_2025 FROM CAMPAIGN_SPEND GROUP BY 1 ORDER BY 1;

-- Issue a programmatic access token (PAT) for the agent's service user.
-- Run this yourself, not through a coding agent, as ACCOUNTADMIN from a normal
-- (password, SSO, or key-pair) session: a session that itself signed in with a
-- PAT cannot issue a token restricted to a different role. Rerunning revokes the
-- previous token and issues a new one.
--
-- sql/01 put the service user under its own network policy. Without one, a
-- TYPE = SERVICE user can neither generate nor use a PAT, and the token works
-- only from the addresses that policy allows.
--
-- Copy token_secret from the ADD result into the agent's environment:
--   export AGENT_PAT='<token_secret>'
-- ROLE_RESTRICTION pins the token to the agent role, so it can reach only the
-- gateway and the MCP tools' objects.

SET svc_user   = 'COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING_SVC';
SET agent_role = 'COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING_AGENT';

USE ROLE ACCOUNTADMIN;

ALTER USER IDENTIFIER($svc_user) REMOVE PROGRAMMATIC ACCESS TOKEN IF EXISTS COOKBOOK_AGENT_PAT;

ALTER USER IDENTIFIER($svc_user) ADD PROGRAMMATIC ACCESS TOKEN COOKBOOK_AGENT_PAT
  ROLE_RESTRICTION = $agent_role
  DAYS_TO_EXPIRY = 7
  COMMENT = 'Cookbook: external LangChain agent token';

-- Read the agent's traces and cost. Run as the ANALYST role (MONITOR on the
-- gateway and no USAGE of its own). Every trace query (1 to 3) is scoped to this
-- recipe's service user and its conversation-id prefix, so other traffic on the
-- account's gateway stays out. The cost query (4) is scoped to the service user
-- only, because billing rows carry no conversation id.
--
-- Traces are best effort: a span can arrive late or not at all, and token totals
-- from traces can come in under metered usage. Bill from OBS.AGENT_GATEWAY_COST
-- (AI_GATEWAY_USAGE_HISTORY), never from AGENT_TRACE_TABLE.

SET cookbook_wh  = 'COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING_WH';
SET analyst_role = 'COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING_ANALYST';
SET svc_user     = 'COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING_SVC';
SET conv_prefix  = 'cookbook-lcmcp-';
SET lookback_h   = 24;

USE ROLE IDENTIFIER($analyst_role);
USE WAREHOUSE IDENTIFIER($cookbook_wh);

-- 1. Turns: one row per trace_id (one user question, one or more model calls).
--    The agent name is the conversation id's middle segment.
WITH spans AS (
  SELECT trace:"trace_id"::STRING                                    AS trace_id,
         record_attributes:"gen_ai.conversation.id"::STRING          AS conversation_id,
         record_attributes:"gen_ai.request.model"::STRING            AS model,
         TRY_TO_NUMBER(record_attributes:"http.status_code"::STRING)  AS http_status,
         record_attributes:"gen_ai.usage.input_tokens"::INT           AS input_tokens,
         record_attributes:"gen_ai.usage.output_tokens"::INT          AS output_tokens,
         start_timestamp, timestamp
  FROM TABLE(AGENT_TRACE_TABLE('SNOWFLAKE'))
  WHERE timestamp >= DATEADD('hour', -$lookback_h, CURRENT_TIMESTAMP())
    AND resource_attributes:"user"::STRING = $svc_user
    AND STARTSWITH(record_attributes:"gen_ai.conversation.id"::STRING, $conv_prefix)
)
SELECT REGEXP_SUBSTR(conversation_id, '^cookbook-lcmcp-(.+)-[0-9a-f]{10}$', 1, 1, 'e') AS agent,
       conversation_id,
       trace_id,
       MIN(start_timestamp)                                          AS started_at,
       COUNT(*)                                                      AS model_calls,
       ANY_VALUE(model)                                              AS model,
       SUM(input_tokens)                                             AS input_tokens,
       SUM(output_tokens)                                            AS output_tokens,
       DATEDIFF('millisecond', MIN(start_timestamp), MAX(timestamp)) AS duration_ms,
       IFF(COUNT_IF(http_status >= 400) = 0, 'SUCCESS', 'FAILURE')   AS status
FROM spans
GROUP BY conversation_id, trace_id
ORDER BY started_at DESC;

-- 2. One turn, span by span. Set trace_id from the query above.
SET trace_id = '<paste a trace_id>';
SELECT trace:"span_id"::STRING                                             AS span_id,
       record:"name"::STRING                                               AS span_name,
       DATEDIFF('millisecond', MIN(start_timestamp) OVER (), start_timestamp) AS offset_ms,
       DATEDIFF('millisecond', start_timestamp, timestamp)                 AS duration_ms,
       record_attributes:"gen_ai.usage.input_tokens"::INT                   AS input_tokens,
       record_attributes:"gen_ai.usage.output_tokens"::INT                  AS output_tokens,
       TRY_TO_NUMBER(record_attributes:"http.status_code"::STRING)          AS http_status
FROM TABLE(AGENT_TRACE_TABLE('SNOWFLAKE'))
WHERE timestamp >= DATEADD('hour', -$lookback_h, CURRENT_TIMESTAMP())
  AND resource_attributes:"user"::STRING = $svc_user
  AND STARTSWITH(record_attributes:"gen_ai.conversation.id"::STRING, $conv_prefix)
  AND trace:"trace_id"::STRING = $trace_id
ORDER BY start_timestamp;

-- 3. What the traces do not contain: MCP tool execution. The gateway records model
--    calls only (operation chat). Tool calls appear inside the next model call's
--    input messages, and only when payload capture is on in the gateway spec.
SELECT record_attributes:"gen_ai.operation.name"::STRING AS operation, COUNT(*) AS spans
FROM TABLE(AGENT_TRACE_TABLE('SNOWFLAKE'))
WHERE timestamp >= DATEADD('hour', -$lookback_h, CURRENT_TIMESTAMP())
  AND resource_attributes:"user"::STRING = $svc_user
  AND STARTSWITH(record_attributes:"gen_ai.conversation.id"::STRING, $conv_prefix)
GROUP BY 1;

-- 4. Cost, from the billing view. Attribution is per user: this is the service
--    user's spend across every agent it ran. Give each agent its own service user
--    if you need cost per agent. ACCOUNT_USAGE lags, so recent calls may be missing.
SELECT model,
       COUNT(DISTINCT request_id) AS requests,
       SUM(input_tokens)          AS input_tokens,
       SUM(output_tokens)         AS output_tokens,
       ROUND(SUM(credits), 6)     AS credits
FROM COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING.OBS.AGENT_GATEWAY_COST
WHERE start_time >= DATEADD('day', -7, CURRENT_TIMESTAMP())
GROUP BY 1
ORDER BY credits DESC;

-- Teardown: drop everything this recipe created. Run as ACCOUNTADMIN. Safe to rerun.
-- This recipe does not change the gateway specification.
--
-- Every name below comes from this SET block, which matches sql/01. Object names
-- in this recipe are fixed; do not edit them here.

SET cookbook_db        = 'COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING';
SET cookbook_wh        = 'COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING_WH';
SET agent_role         = 'COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING_AGENT';
SET analyst_role       = 'COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING_ANALYST';
SET svc_user           = 'COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING_SVC';
SET svc_network_policy = 'COOKBOOK_LANGCHAIN_MCP_AGENT_TRACING_SVC_POLICY';

USE ROLE ACCOUNTADMIN;

-- Dropping the user revokes its token. The network policy must be detached
-- before it can be dropped, and dropped before the database that holds its
-- network rule.
ALTER USER IF EXISTS IDENTIFIER($svc_user) UNSET NETWORK_POLICY;
DROP USER IF EXISTS IDENTIFIER($svc_user);
DROP NETWORK POLICY IF EXISTS IDENTIFIER($svc_network_policy);

-- Dropping the database drops the MCP server, search service, semantic view,
-- tables, cost view, and the network rule.
DROP DATABASE IF EXISTS IDENTIFIER($cookbook_db);
DROP WAREHOUSE IF EXISTS IDENTIFIER($cookbook_wh);
-- Dropping the roles also removes their USAGE and MONITOR grants on the gateway.
DROP ROLE IF EXISTS IDENTIFIER($agent_role);
DROP ROLE IF EXISTS IDENTIFIER($analyst_role);

SHOW GRANTS ON AI GATEWAY SNOWFLAKE;