GRANT OWNERSHIP: Transferring ownership requires the target role to be active in the current session or the executing role to have MANAGE GRANTS (Pending)¶

Attention

This behavior change is in the 2026_07 bundle.

For the current status of the bundle, refer to Bundle history.

When you transfer ownership of an object using GRANT OWNERSHIP, Snowflake now enforces an additional authorization check on the target role.

Before the change:

GRANT OWNERSHIP ON <object_type> <object_name> TO ROLE <target_role> succeeded regardless of whether <target_role> was activated in the current session.

After the change:

GRANT OWNERSHIP succeeds only if one of the following conditions is met:

The target role is activated in the current session (that is, it appears in the output of CURRENT_AVAILABLE_ROLES).
The executing role has account-level MANAGE GRANTS privilege.

If neither condition is met, Snowflake returns the following error:

SQL compilation error: <object_domain> ownership can only be transferred to a role
that is activated in the current session or by a role with account-level MANAGE GRANTS.

This change is being made to prevent unintended privilege escalation by restricting ownership transfers to roles that the executing user is authorized to act on behalf of.

Ref: 2395