--- title: "Restrict What an Agent Can Do Without Rewriting Your Role Hierarchy: Restricted Session Scope" url: https://daily.dev/posts/restrict-what-an-agent-can-do-without-rewriting-your-role-hierarchy-restricted-session-scope-encdwkfwi source_url: https://medium.com/snowflake/limit-ai-agent-privileges-in-snowflake-restricted-session-scope-503691b19de2 type: article source: "Snowflake Community" published: 2026-08-24T19:17:42.330Z updated: 2026-08-26T10:15:46.932Z tags: ["ai-agents", "big-data", "snowflake"] reading_time: 6 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Restrict What an Agent Can Do Without Rewriting Your Role Hierarchy: Restricted Session Scope **[Snowflake Community](https://daily.dev/sources/snowflake_comm)** · 6 min read · 0 upvotes · 0 comments ## Summary Snowflake CoCo now supports Restricted Session Scope (RSS), a privilege ceiling that limits what an AI agent can do on a user's behalf without requiring a new role hierarchy. RSS is defined as YAML with privilege and role scopes, and it only ever restricts, never grants beyond what the user's RBAC roles already allow. Administrators can set it account-wide via a session policy (AGENT_RESTRICTED_SESSION_SCOPE), or users can apply it themselves through the CoCo CLI's /guardrails flow. Key caveats: it only engages when IS_AGENT_ACTIVATED is true, doesn't apply to Snowpark Container Services workloads yet, role blocklists only cover directly granted roles, and it doesn't mask column-level data on its own. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is Restricted Session Scope in Snowflake CoCo and how does it limit AI agent privileges? Restricted Session Scope (RSS) is a privilege ceiling in Snowflake CoCo that limits what an AI agent can do on a user's behalf, defined as a YAML document with privilege scopes and role scopes. It never grants privileges beyond what the user already holds through RBAC; the effective privileges while an agent is active are the intersection of the user's RBAC privileges and the active RSS. It applies only when IS_AGENT_ACTIVATED is TRUE. _daily.dev tracks releases like this for engineers rolling out AI agent access controls in production._ ### What are the three predefined restricted session scopes in Snowflake for limiting agent access? Snowflake offers three predefined scopes: SNOWFLAKE$DATA_READ, which grants read-only access to data objects; SNOWFLAKE$DATA_READ_WITH_AI, which extends read access to AI and agent objects but excludes stored procedures since they may run with owner's rights; and SNOWFLAKE$DATA_READ_PROGRAM_USAGE, which allows invoking UDFs and stored procedures instead. _Engineers configuring agent guardrails follow releases like this one on daily.dev._ ### What are the current limitations of Snowflake's Restricted Session Scope for AI agents? Five limitations exist in preview: surface support across CoCo clients is still filling in; RSS does not apply to workloads run through Snowpark Container Services (SPCS); role allowlists and blocklists only suppress roles granted directly, not those reached through nested inheritance; an active RSS cannot be widened once applied; and agent context is not universal, since agents connecting via REST or an SDK with key pair or PAT auth do not currently trigger IS_AGENT_ACTIVATED. _Teams evaluating agent access controls track edge cases like these on daily.dev before deploying to production._ ## Similar posts on daily.dev - [Governed AI for Every Builder: Enterprise Controls in Snowflake CoCo](https://daily.dev/posts/governed-ai-for-every-builder-enterprise-controls-in-snowflake-coco-uk5mcnnud) · Snowflake · 0 upvotes · 0 comments - [Context Engineering with Snowflake CoCo CLI, Part 2: Runtime Enforcement and Scaling Complex Work](https://daily.dev/posts/context-engineering-with-snowflake-coco-cli-part-2-runtime-enforcement-and-scaling-complex-work-f0wbg7pc3) · Snowflake Community · 1 upvotes · 0 comments - [Why AI Agents Need Their Own Permission Model](https://daily.dev/posts/why-ai-agents-need-their-own-permission-model-lclnk1x7x) · Auth0 · 0 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#big-data](https://daily.dev/tags/big-data), [#snowflake](https://daily.dev/tags/snowflake) [View this post on daily.dev](https://daily.dev/posts/restrict-what-an-agent-can-do-without-rewriting-your-role-hierarchy-restricted-session-scope-encdwkfwi)