A deep technical breakdown of Snowflake CoWork Automations, now in Public Preview (August 2026), covers the new 'agent task' primitive that fires a full Cortex Agent run — with LLM orchestration, tool use, and SQL generation — on a recurring schedule rather than executing fixed SQL. It details the new EXECUTE AGENT TASK privilege (granted to PUBLIC by default via BCR-2349), the multi-layer execution architecture (task scheduler, Cortex Agent API, thread persistence/email delivery), the tool execution chain (Cortex Analyst, Cortex Search, custom UDFs/SPs), the caller's-rights security model, cost anatomy of a single run, and operational patterns for platform teams including tiered access control and monitoring. Known preview limitations include no programmatic API for Terraform/CI-CD management.
Table of contents
IntroductionThe Agent Task PrimitiveExecution ArchitectureThe Tool Execution ChainCustom Tools (UDFs/Stored Procedures)Security Model: Caller’s Rights at Every LayerCost Anatomy of a Single Automation RunOperational Patterns for Platform TeamsComparing Automation ArchitecturesThread Model and State ManagementKnown Limitations and Gaps (Preview)ConclusionQuestions this post answers
What is the EXECUTE AGENT TASK privilege in Snowflake and is it granted to PUBLIC by default?
EXECUTE AGENT TASK is a new account-level global privilege controlling who can create and run Snowflake agent tasks, introduced with CoWork Automations Public Preview on August 6, 2026 via BCR-2349. Unlike EXECUTE TASK, it is granted to PUBLIC by default, meaning every user can create automations unless an admin explicitly revokes it from role PUBLIC. Track privilege and access-control changes like this one on daily.dev before they hit your Snowflake account.
How does Snowflake CoWork Automations handle security when running scheduled agent tasks?
Snowflake agent tasks execute with caller's rights throughout the entire stack, meaning the automation runs under the permissions of the user who owns it rather than an elevated owner's-rights context. Row access policies and masking policies apply per-user, RBAC changes take effect on the next run automatically, and there is no possibility of privilege escalation since access is limited to what's available via interactive query. Compare execution-rights models across data platforms on daily.dev before choosing how to secure automations.
What are the current limitations of Snowflake CoWork Automations in public preview?
The biggest gap is the lack of a programmatic API, so automations cannot be created via Terraform or Pulumi, version-controlled, bulk-managed across an organization, or integrated into CI/CD pipelines. Additionally, every run performs a full non-deterministic agent reasoning pass with no lightweight mode, so token costs scale linearly with automation count and frequency. Follow preview-stage tooling gaps like these on daily.dev before committing automation workflows to production.