Snowflake CoWork Automations: EXECUTE AGENT TASK privilege granted to PUBLIC by default¶

Snowflake CoWork Automations access behaves as follows:

New privilege:

The EXECUTE AGENT TASK privilege on the account is granted to the PUBLIC role by default. Administrators can still revoke the privilege from PUBLIC and grant it only to selected roles.

This additive change reduces onboarding friction for Snowflake CoWork Automations while preserving administrator control to restrict access when needed.

To manage Automations access¶

To disable Automations for all users, revoke the privilege from PUBLIC:

REVOKE EXECUTE AGENT TASK ON ACCOUNT FROM ROLE PUBLIC;

To enable Automations for specific roles only, revoke from PUBLIC first, then grant to the roles you choose:

REVOKE EXECUTE AGENT TASK ON ACCOUNT FROM ROLE PUBLIC;
GRANT EXECUTE AGENT TASK ON ACCOUNT TO ROLE <role_name>;

Ref: 2349