Snowflake announced a new control system designed to govern how AI agents access enterprise data, tools, and models, addressing a fundamental security problem that decades-old enterprise systems never anticipated. The company unveiled Cortex AI Gateway on Tuesday alongside integrations with identity vendors including 1Password, Aembit, Linx Security, SailPoint, and Saviynt. The announcement signals a broader industry reckoning: as autonomous AI agents become commonplace in enterprises, the security assumptions that protected human-driven workflows are breaking down.

What Happens When AI Agents Inherit Your Admin Credentials?

The core problem is deceptively simple but dangerous. When enterprises deploy AI agents, the default approach has been to give the agent the same credentials and permissions as the human who created it. If that human is a security administrator or IT leader with broad access, the agent suddenly inherits that same sweeping authority. Nancy Wang, chief technology officer of 1Password, described the failure mode in stark terms: an agent could exfiltrate data, transfer millions of dollars to offshore accounts, or execute unauthorized actions if compromised by a prompt injection attack. Worse, the audit logs would show the human's name, not the agent's, making it impossible to distinguish between legitimate human actions and rogue agent behavior.

The deeper issue is that enterprise security architecture has operated under an assumption that no longer holds true. For decades, security models assumed people would be the actors accessing systems, operating at human speed and within relatively defined boundaries. Mayank Upadhyay, Snowflake's chief security and trust officer, explained that the challenge isn't that AI creates entirely new security problems; rather, it exposes blind spots that have always existed. Organizations have never had perfect visibility into every API, dataset, and workflow, but at human speed those gaps were manageable. Agents operating at machine speed can combine access across systems and act on permissions that were never intended to be exercised together, amplifying longstanding risks.

How Does Cortex AI Gateway Actually Control Agent Access?

Cortex AI Gateway functions as a centralized control layer that will enter public preview soon. It governs access for both first-party agents built inside Snowflake, such as Snowflake CoWork and CoCo, and third-party agents built on external platforms. The gateway supports more than 100 MCP servers, the Model Context Protocol connectors that have become the standard for wiring agents to enterprise tools. By centralizing access policies, authentication, permissions, and audit logging in one place, the system aims to prevent agents from operating with unchecked authority.

The technical centerpiece of the partner integrations is what Snowflake calls dual attribution. This approach logs both the verified non-human identity of the agent and the specific human who authorized the task, ensuring task-scoped access and complete auditability for every action. The principle of task-scoped access means agents receive only the permissions needed for a specific task, rather than inheriting a user's full standing permissions. Upadhyay acknowledged the obvious challenge: agents are dynamic and their next step often isn't known in advance. The solution is to evaluate every action an agent takes in real time against appropriate policies, scope, contextual signals, and the original intent of the user.

Wang explained how 1Password's integration works at the protocol level using emerging standards like OIDC-A. When a human authorizes an agent to perform a specific task, the agent receives a delegated task-specific token that includes the original delegator's identity and the intent behind the task. This matters because enterprise tasks decompose into enormous chains of individual operations. When an agent accesses a table, it's acting on behalf of the original intent provided by the human. A single task might comprise hundreds or even thousands of individual actions, and keeping that intent intact across every step while flagging any deviation is what Snowflake and its partners are trying to standardize.

Ways to Implement Agent Governance in Your Enterprise

• Establish Dual Attribution Logging: Implement systems that record both the agent's identity and the human who authorized the task, creating an audit trail that distinguishes between human actions and agent actions.
• Enforce Task-Scoped Access: Limit agent permissions to only what is required for a specific task rather than granting broad permissions inherited from a human user account.
• Implement Real-Time Policy Evaluation: Set up continuous verification of agent actions against enterprise policies, contextual signals, and the original user intent throughout the entire workflow.
• Centralize Agent Access Management: Use a unified control plane that governs access policies, authentication, and permissions for both first-party and third-party agents across the organization.
• Monitor AI Consumption Costs: Track which teams, agents, and workloads are driving AI spending and enforce spending limits before costs spiral out of control.

Why Is Runaway AI Spending Becoming an Urgent Problem?

Beyond security, Cortex AI Gateway addresses a less glamorous but increasingly urgent problem: controlling AI costs. The gateway gives IT and finance teams a unified view of AI consumption, attributes costs to the specific teams, agents, or workloads driving them, and enforces spending limits before bills spiral. Upadhyay described how costs compound in practice. AI is dynamic; agents can invoke multiple models, call different tools, and execute multi-step workflows, creating consumption patterns that change from one task to the next. An enterprise might deploy an AI assistant to help employees answer internal questions, but a simple request that only requires retrieving a document could unintentionally be routed through a more expensive reasoning model, trigger additional searches across multiple systems, or invoke unnecessary workflows. At scale, with thousands of employees and hundreds of agents, small inefficiencies become significant line items.

The announcement builds directly on Snowflake's May 2026 acquisition of Natoma, a 27-person startup whose centralized MCP gateway enforced identity, policy, and audit at the tool-call level. The deal was announced the same day as Snowflake's $1.33 billion quarterly product revenue report and a $6 billion AWS compute commitment, but it revealed where Snowflake believes the next platform fight sits: not in the data warehouse, but in the layer that decides what an agent may touch and records what it did.

"The next era of AI won't be built through more walled gardens. It will be built through secure agent interoperability," said Mayank Upadhyay, Snowflake's chief security and trust officer. "If every vendor builds a closed ecosystem of agents, enterprises simply recreate the fragmentation they've spent years trying to solve."

Mayank Upadhyay, Chief Security and Trust Officer at Snowflake

The lineup of security integrations is itself notable. Snowflake partnered with 1Password, Aembit, Linx Security, SailPoint, and Saviynt, an unusual collection of identity vendors who often compete with one another. Their alignment around a shared trust model for autonomous agents suggests the industry recognizes that agent governance is becoming a foundational infrastructure problem, not a competitive advantage to be hoarded.

As enterprises move from experimenting with AI agents to deploying them at scale, the security and cost control challenges Snowflake is addressing will only intensify. The company's bet is that the organization that controls how agents access data and resources will become as essential to enterprise infrastructure as the data warehouse itself.