rbac

name	rbac
title	Snowflake RBAC Patterns
summary	Router skill for designing Snowflake Role-Based Access Control hierarchies and access role patterns.
description	Use when designing or refactoring Snowflake RBAC: choosing a role hierarchy, creating database/schema access roles, setting up functional roles, deciding between primary and secondary roles, or referencing roles in masking and row access policies. Routes to focused sub-flows for each layer of the hierarchy. Triggers: rbac, role hierarchy, access roles, functional roles, schema access role, database access role, warehouse access role, secondary roles, policy roles, role design, grant, managed access schema, future grants
tools	["snowflake_sql_execute","Read","Write","Edit","Grep","Glob"]
prompt	Help me design an RBAC hierarchy for my Snowflake account.
language	en
status	Published
author	Snowflake Solutions Team
type	community

Snowflake RBAC Patterns

Overview

This skill is a router for designing Snowflake Role-Based Access Control. It helps you pick a role hierarchy that fits your account, then routes to focused sub-flows for each layer (account roles, environment admins, domain admins, database access roles, schema access roles) and cross-cutting concerns (personas, warehouses, secondary roles, policy roles).

If you are new to RBAC, start with architecture-patterns/INSTRUCTIONS.md to decide which layers your organization actually needs. Most accounts do not need all six.

When to Use

Use this skill when you need to:

• Design a fresh RBAC hierarchy for a new Snowflake account.
• Refactor an existing role mess into a clean access-role pattern.
• Create read/write/create roles for databases or schemas.
• Decide between functional (persona) roles and data-product access roles.
• Reference roles correctly in masking or row access policies.

When NOT to Use

Delegate to bundled skills for non-RBAC concerns:

Topic	Delegate to
Multi-account strategy, org-level governance	organization-management
Cross-account data sharing via listings	internal-marketplace-org-listing
Writing masking / row access policy SQL	data-governance
Declarative sharing or application packages	declarative-sharing

This skill tells you which roles to reference. Those skills handle policy implementation and sharing mechanics.

Full Role Hierarchy

1. OOB Account Roles (ACCOUNTADMIN, SYSADMIN, USERADMIN, SECURITYADMIN)
   └── 2. Environment Admin Roles (DEV_ADMIN, PROD_ADMIN)
       └── 3. Business Domain Admins (federated / hub-spoke)
           └── 4. Data Product Admins (per team)
               └── 5. Database Access Roles (DB_R, DB_RW, DB_C)
                   └── 6. Schema Access Roles (<schema>_R, _RW, _C)

Sub-Flows

Layer / Topic	File
Pick a hierarchy	architecture-patterns/INSTRUCTIONS.md
Persona-aligned roles	personas/INSTRUCTIONS.md