Data quality: EXECUTE DATA METRIC FUNCTION granted to SNOWFLAKE.PUBLIC by default (Pending)¶

Snowflake will grant the EXECUTE DATA METRIC FUNCTION privilege to the SNOWFLAKE.PUBLIC application role. Account roles inherit that grant, so they can run scheduled data metric functions without a separate account grant. This change isn’t part of a behavior change bundle, and you can’t turn it on or off with SYSTEM$ENABLE_BEHAVIOR_CHANGE_BUNDLE or SYSTEM$DISABLE_BEHAVIOR_CHANGE_BUNDLE.

Important

The release date isn’t set. The privilege isn’t granted yet. Set the opt-out parameter before the grant if you don’t want every account role to receive it. Setting the parameter doesn’t revoke a grant that already exists.

Before the change:

A role needs the EXECUTE DATA METRIC FUNCTION privilege on the account to associate a data metric function with a table or view and to run a scheduled data metric function. An account administrator grants that privilege to each role that needs it.

To set the DATA_METRIC_SCHEDULE parameter on a table, the role needs OWNERSHIP on the table, or any other privilege on the table plus EXECUTE DATA METRIC FUNCTION on the account.

After the change:

Snowflake grants EXECUTE DATA METRIC FUNCTION to the SNOWFLAKE.PUBLIC application role. SNOWFLAKE.PUBLIC is granted to the account-level PUBLIC role, so account roles inherit the privilege.

Database roles don’t inherit SNOWFLAKE.PUBLIC. A database role still can’t satisfy this account privilege. Native apps don’t receive the privilege on SNOWFLAKE.APP_PUBLIC. An installed app doesn’t run scheduled data metric functions. Apps that view results continue to use the SNOWFLAKE.DATA_METRIC_USER database role.

For an account role, any privilege on a table is enough to set DATA_METRIC_SCHEDULE. USAGE on the data metric function, and OWNERSHIP or SELECT with EXECUTE AS ROLE on the table, are unchanged.

Opt out before the grant¶

To keep today’s behavior, set DISABLE_EXECUTE_DATA_METRIC_FUNCTION_GRANT_TO_PUBLIC to TRUE before Snowflake creates the grant:

ALTER ACCOUNT SET DISABLE_EXECUTE_DATA_METRIC_FUNCTION_GRANT_TO_PUBLIC = TRUE;

The setting takes effect the next time Snowflake runs setup or upgrade for your account. It doesn’t revoke a grant that already exists. The default is FALSE.

Revoke or restore the grant¶

SNOWFLAKE.PUBLIC is an application role on the SNOWFLAKE database. It isn’t the account-level PUBLIC role. SHOW GRANTS TO ROLE PUBLIC doesn’t list this grant.

Confirm the grant as ACCOUNTADMIN:

SHOW GRANTS TO APPLICATION ROLE SNOWFLAKE.PUBLIC;

After the grant exists, revoke it with the SNOWFLAKE.LOCAL procedure. A REVOKE EXECUTE DATA METRIC FUNCTION ON ACCOUNT FROM ROLE PUBLIC statement doesn’t remove the SNOWFLAKE.PUBLIC grant.

CALL SNOWFLAKE.LOCAL.REVOKE_FROM_PUBLIC_APPLICATION_ROLE(
  'PRIVILEGE',
  'EXECUTE_DATA_METRIC_FUNCTION'
);

To grant it again:

CALL SNOWFLAKE.LOCAL.GRANT_TO_PUBLIC_APPLICATION_ROLE(
  'PRIVILEGE',
  'EXECUTE_DATA_METRIC_FUNCTION'
);

You can still grant the privilege to individual roles with GRANT EXECUTE DATA METRIC FUNCTION ON ACCOUNT TO ROLE <role_name>.

Change log¶

Update	Date
Initial publication	26-Oct-26

Ref: 2471