Snowflake CoCo now supports Restricted Session Scope (RSS), a privilege ceiling that limits what an AI agent can do on a user's behalf without requiring a new role hierarchy. RSS is defined as YAML with privilege and role scopes, and it only ever restricts, never grants beyond what the user's RBAC roles already allow. Administrators can set it account-wide via a session policy (AGENT_RESTRICTED_SESSION_SCOPE), or users can apply it themselves through the CoCo CLI's /guardrails flow. Key caveats: it only engages when IS_AGENT_ACTIVATED is true, doesn't apply to Snowpark Container Services workloads yet, role blocklists only cover directly granted roles, and it doesn't mask column-level data on its own.
Table of contents
The ceiling model: RSS never grants, only limitsRestrict your own session from the CLIGet Luke Hartzell’s stories in your inboxWhat to know before you rely on itWhat’s next?Questions this post answers
What is Restricted Session Scope in Snowflake CoCo and how does it limit AI agent privileges?
Restricted Session Scope (RSS) is a privilege ceiling in Snowflake CoCo that limits what an AI agent can do on a user's behalf, defined as a YAML document with privilege scopes and role scopes. It never grants privileges beyond what the user already holds through RBAC; the effective privileges while an agent is active are the intersection of the user's RBAC privileges and the active RSS. It applies only when IS_AGENT_ACTIVATED is TRUE. daily.dev tracks releases like this for engineers rolling out AI agent access controls in production.
What are the three predefined restricted session scopes in Snowflake for limiting agent access?
Snowflake offers three predefined scopes: SNOWFLAKE$DATA_READ, which grants read-only access to data objects; SNOWFLAKE$DATA_READ_WITH_AI, which extends read access to AI and agent objects but excludes stored procedures since they may run with owner's rights; and SNOWFLAKE$DATA_READ_PROGRAM_USAGE, which allows invoking UDFs and stored procedures instead. Engineers configuring agent guardrails follow releases like this one on daily.dev.
What are the current limitations of Snowflake's Restricted Session Scope for AI agents?
Five limitations exist in preview: surface support across CoCo clients is still filling in; RSS does not apply to workloads run through Snowpark Container Services (SPCS); role allowlists and blocklists only suppress roles granted directly, not those reached through nested inheritance; an active RSS cannot be widened once applied; and agent context is not universal, since agents connecting via REST or an SDK with key pair or PAT auth do not currently trigger IS_AGENT_ACTIVATED. Teams evaluating agent access controls track edge cases like these on daily.dev before deploying to production.