Snowflake agent blast radius: CoCo automations run-as identity and the two month evidence window · Enterprise Agentic AI Insights
Snowflake CoCo automations run as the creator's default role plus all secondary roles, with approval prompts off and 61 days of run history. Run the numbers.
What the CDO is staring at this week There is a new object in the data estate that nobody put on the platform roadmap. On 21 August 2026, Snowflake moved CoCo automations to public preview in both the CoCo CLI and Snowsight. An automation turns a saved prompt into a recurring, unattended run that executes in a Snowflake-managed sandbox, on a schedule, whether or not anyone has a browser open. Minimum frequency is once per hour. It does not need a warehouse. VERIFIED C01 That last detail is the one that skips the usual review. A scheduled agent consumes standard task billing plus CoCo tokens per run, and none of it lands in the warehouse credit review where the data platform team looks for surprises. VERIFIED C01 So the first honest answer to "how many autonomous processes are running against our data estate" is that most teams do not know, and the place they would normally look does not show it. --- The mechanic that is strained Three sentences from Snowflake's product documentation define the whole exposure. They are worth reading in the vendor's words rather than anyone's summary. One. The run does not use the role you had active. "A run does not use the role that was active in your CoCo session when you created the automation. That role is not recorded on the agent task. Each run starts a task session whose primary role is your user's default role, with your user's default secondary roles activated." VERIFIED C01 Two. Snowflake states the reach plainly. "If the user's default secondary roles include every role granted to them, a run can reach any object that the user can reach through any of their roles." VERIFIED C01 Three. The approval model is switched off. "Automation runs are unattended, so interactive tool permission prompts are disabled. Tools that are available to the run can execute without waiting for approval." VERIFIED C01 Put those together and the picture is specific rather than alarming. Role-based access control still applies. Row access policies still apply. Masking policies still apply. What is gone is the human at the confirmation dialog, which means the only boundary left standing is the exact boundary set by a field most organizations have treated as a login convenience for a decade. DEFAULTROLE was never a security control. It just became an execution identity. Two smaller items compound it. The privilege that permits scheduling, EXECUTE AGENT TASK, is granted to the PUBLIC role by default, so every user in the account has it unless an administrator changes the grant. VERIFIED C01 And a pre-run or post-run hook that exits non-zero does not fail the run. Task history records success. The guardrail you wrote can silently not execute while your monitoring reports green. VERIFIED C01 --- The number nobody has run yet: evidence half-life This is where the data estate problem becomes a board problem, and it is arithmetic rather than opinion. Snowflake's documentation sets a preview limit: automation threads and run history are retained for two months. VERIFIED C01 The SNOWFLAKECOCOUSAGEHISTORY view carries usage telemetry for a year. The TASKHISTORY table function returns roughly the past seven days. CITED C02 Now line those windows up against how long an enterprise is expected to be able to explain an action. | Evidence window | Duration | What it covers | |---|---|---| | TASKHISTORY table function | 7 days | Run state, error, query ID CITED C02 | | CoCo automation thread and run history | 61 days | Tool calls, results, final response VERIFIED C01 | | SNOWFLAKECOCOUSAGEHISTORY | 365 days | User, request, token credits, role metadata CITED C02 | | EU AI Act Article 19 log floor, high-risk | 180 days minimum | Automatically generated logs CITED C03 | | SEC Rule 17a-4 books and records | 1,095 days and up | Broker-dealer records CITED C04 | | HIPAA documentation retention | 2,190 days | Covered entity documentation CITED C05 | The transcript is the only artifact that shows what the agent actually did, which tools it called, and what came back. That artifact has a two month half-life. Every duty in the lower half of that table outlives it by a factor of three to thirty-six. The failure is not that an agent does something wrong. The failure is being asked, eleven months later, to explain an action and having only a token count left. --- Interactive: unattended agent blast radius calculator Run your own numbers. Nothing is sent anywhere. The inputs map to queries you can run yourself in the control sheet below. <div id="ad-blast-calc" style="font-family:Roboto,'Helvetica Neue',Arial,sans-serif;background:0D0F12;border:1px solid rgba(7,163,209,0.35);border-radius:16px;padding:28px;margin:32px 0;box-shadow:0 18px 50px rgba(0,0,0,0.45), inset 0 1px 0 rgba(255,255,255,0.08);" <div style="font-size:13px;font-weight:600;letter-spacing:0.14em;text-transform:uppercase;color:07A3D1;margin-bottom:8px;"Ariana.Digital · AEGIS Diagnostic tool</div <h3 style="font-family:Radley,Georgia,serif;font-size:28px;line-height:1.25;color:rgba(237,232,227,1);margin:0 0 8px;"Unattended agent blast radius calculator</h3 <p style="font-size:16px;font-weight:500;line-height:1.55;color:rgba(237,232,227,0.88);margin:0 0 24px;"Five inputs. Two of them you can pull with a single query. The output is the sentence you owe your risk committee.</p <div style="display:grid;grid-template-columns:repeat(auto-fit,minmax(240px,1fr));gap:20px;" <label style="display:block;font-size:15px;font-weight:600;color:rgba(237,232,227,0.88);"Users able to schedule an agent <input id="adc-users" type="number" min="1" value="400" style="width:100%;margin-top:8px;padding:12px;font-size:16px;font-family:Roboto,sans-serif;font-weight:500;color:0D0F12;background:EDE8E3;border:2px solid rgba(7,163,209,0.4);border-radius:8px;min-height:44px;" </label <label style="display:block;font-size:15px;font-weight:600;color:rgba(237,232,227,0.88);"Average roles granted per user <input id="adc-roles" type="number" min="1" value="7" style="width:100%;margin-top:8px;padding:12px;font-size:16px;font-family:Roboto,sans-serif;font-weight:500;color:0D0F12;background:EDE8E3;border:2px solid rgba(7,163,209,0.4);border-radius:8px;min-height:44px;" </label <label style="display:block;font-size:15px;font-weight:600;color:rgba(237,232,227,0.88);"Percent with secondary roles set to ALL <input id="adc-all" type="number" min="0" max="100" value="95" style="width:100%;margin-top:8px;padding:12px;font-size:16px;font-family:Roboto,sans-serif;font-weight:500;color:0D0F12;background:EDE8E3;border:2px solid rgba(7,163,209,0.4);border-radius:8px;min-height:44px;" </label <label style="display:block;font-size:15px;font-weight:600;color:rgba(237,232,227,0.88);"Scheduled runs per day, estate wide <input id="adc-runs" type="number" min="0" value="120" style="width:100%;margin-top:8px;padding:12px;font-size:16px;font-family:Roboto,sans-serif;font-weight:500;color:0D0F12;background:EDE8E3;border:2px solid rgba(7,163,209,0.4);border-radius:8px;min-height:44px;" </label <label style="display:block;font-size:15px;font-weight:600;color:rgba(237,232,227,0.88);"Your record-keeping duty <select id="adc-duty" style="width:100%;margin-top:8px;padding:12px;font-size:16px;font-family:Roboto,sans-serif;font-weight:500;color:0D0F12;background:EDE8E3;border:2px solid rgba(7,163,209,0.4);border-radius:8px;min-height:44px;" <option value="6"6 months, EU AI Act Art. 19 floor</option <option value="36" selected36 months, SEC 17a-4 style</option <option value="72"72 months, HIPAA style</option <option value="84"84 months, SOX style</option </select </label <label style="display:block;font-size:15px;font-weight:600;color:rgba(237,232,227,0.88);"Transcripts exported to durable storage <select id="adc-export" style="width:100%;margin-top:8px;padding:12px;font-size:16px;font-family:Roboto,sans-serif;font-weight:500;color:0D0F12;background:EDE8E3;border:2px solid rgba(7,163,209,0.4);border-radius:8px;min-height:44px;" <option value="0" selectedNo, we rely