Application roles

The RAI Native App uses Snowflake role-based access control (RBAC). The app exposes application roles that the Native App owner can grant to Snowflake account roles. Users then get access when an admin grants them one of those account roles.

To give users the standard RAI_ADMIN or RAI_DEVELOPER account role, see Grant user access. Use this page to look up individual application roles, bundle them into a custom role, revoke them, or delegate grants to another admin.

All available application roles

The following application roles are available in the RAI Native App. The tables group them into integrated, service, resource, and observability roles.

Integrated roles

These roles combine multiple service and resource roles into roles for common access patterns.

Application Role	Description
`rai_user`	The minimum set of service and resource roles required to run PyRel semantic models using the RAI Python API. Includes the `app_user`: Can use the RAI Native App. `eng_user`: Can use RAI reasoners. `eng_admin`: Can create and delete RAI reasoners. `cdc_admin`: Can create, delete, and manage data streams. `all_schema_cdc`: Can manage data streams for all models.
`all_admin`	Enables management of all app resources and the RAI SPCS service. Includes all application roles. Recommended for users who need full permissions for the RAI Native App.

Service roles

Service roles provide access to the RAI Native App, its logs, and billing information.

Application Role	Description
`app_user`	Enables usage of the RAI Native App.
`app_admin`	Enables management of the app and the RAI SPCS service. Includes the `app_user` role.
`billing_admin`	Enables access to billing and consumption data tracked by the app. Includes the `app_user` role.
`sensitive_logs`	Enables access to sensitive logs. Includes the `app_user` role.

Resource roles

Resource roles provide access to all of the RAI Native App’s resources.

Application Role	Description
`all_resource_admin`	Enables management of all app resources. Includes the `cdc_admin`, `eng_admin`, `schema_admin`, `all_schema_all`, and `rai_user` roles. Recommended for users who need full permissions for application resources.
`cdc_admin`	Enables management of the CDC Service and creating/deleting data streams. Includes the `app_user` role.
`eng_admin`	Enables creating and deleting reasoners. Includes the `app_user` and `eng_user` roles.
`eng_user`	Enables viewing and using RAI reasoners. Includes the `app_user` role.
`schema_viewer`	Enables listing and viewing model data resources. Includes the `app_user` role.
`schema_admin`	Enables creating, cloning, and deleting model data resources. Includes the `schema_viewer` role.
`all_schema_ro`	Enables read-only operations on all model data resources. Includes the `eng_user`, `schema_viewer`, and `app_user` roles.
`all_schema_rw`	Enables read/write transactions on all model data resources. Includes the `all_schema_ro` role.
`all_schema_cdc`	Enables management of data streams for all model data resources. Includes the `schema_viewer` and `app_user` roles.
`all_schema_all`	Enables read/write transactions and data stream management for all model data resources. Includes the `all_schema_rw` and `all_schema_cdc` roles.

Observability roles

These roles provide access to the RAI Native App’s observability features.

Application Role	Description
`observability_viewer`	Enables read-only access to the app’s observability views for monitoring reasoner usage. Includes the `app_user` role.
`observability_admin`	Enables observability setup and management, such as registering or unregistering the events view. Includes the `observability_viewer` role.

Build a custom user role

Use this workflow when RAI_ADMIN is too broad and RAI_DEVELOPER does not match the workflow. This lets you create an account role that bundles only the application roles the user needs.

Create a new account role

Create the Snowflake account role that you want users to receive:
```
CREATE ROLE MY_CUSTOM_ROLE;
```
Grant application roles to the account role

Choose the application roles that match the user’s workflow from All available application roles, then grant them to the new account role:
```
GRANT APPLICATION ROLE RELATIONALAI.<application_role_name> TO ROLE MY_CUSTOM_ROLE;
```
Grant the account role to a user

Once the custom role contains the right application roles, grant it to the target user:
```
GRANT ROLE MY_CUSTOM_ROLE TO USER <user_name>;
```
Verify the role assignment

Inspect the role grants to confirm that the custom role includes the expected application roles and that the user now has the account role:
```
SHOW GRANTS TO ROLE MY_CUSTOM_ROLE;
SHOW GRANTS TO USER <user_name>;
```

Revoke access

Use the table below to choose the workflow you need for revoking access, then follow the steps to revoke it in Snowflake SQL.

What to use	When to use it
Revoke access for a user	Use this when a specific user should no longer receive access through a Snowflake account role such as `RAI_ADMIN`, `RAI_DEVELOPER`, or a custom role.
Revoke access for an account role	Use this when an account role should no longer include one or more RAI application roles.

Revoke access for a user

Use this workflow when a user should no longer receive access through a specific Snowflake account role. This follows standard Snowflake role management and removes the user’s access path through that role.

Choose the account role to remove

Identify the Snowflake account role that currently gives the user access, such as RAI_ADMIN, RAI_DEVELOPER, or a custom role.
Revoke the account role from the user

Remove the Snowflake account role from the user:
```
REVOKE ROLE <role_name> FROM USER <user_name>;
```
Verify the role assignment was removed

Inspect the user’s grants in Snowflake to confirm that the account role is no longer present:
```
SHOW GRANTS TO USER <user_name>;
```

Revoke access for an account role

Requires RAI Native App ownership privileges.

Use this workflow when a custom Snowflake account role should no longer include one of its RAI application roles. This changes what that account role can do in the native app without deleting the Snowflake role itself.

Choose the application role to remove

Inspect the account role’s current grants so you can see which RAI application roles it already includes:
```
SHOW GRANTS TO ROLE <role_name>;
```
Use that output together with the reference in All available application roles to decide which application role to remove.
Revoke the application role from the account role

Remove the application role from the Snowflake account role:
```
REVOKE APPLICATION ROLE relationalai.<app_role_name> FROM ROLE <role_name>;
```
Verify the role assignment was removed

Inspect the account role’s grants in Snowflake to confirm that the application role is no longer present:
```
SHOW GRANTS TO ROLE <role_name>;
```

Delegate access control

Requires OWNERSHIP privileges on the RAI Native App.

If you are an owner of the RAI Native App but want to delegate some access control tasks to another admin, you can create stored procedures that run with EXECUTE AS OWNER privileges to manage application role grants. Then, you can grant that admin permission to execute those procedures without giving them broader ownership privileges on the native app.

Create a procedure for granting application roles

Create the grant procedure

Create a stored procedure that grants an RAI application role to a Snowflake account role:

CREATE PROCEDURE GRANT_RAI_APP_ROLE(app_role STRING, target_role STRING)
RETURNS TABLE(STRING)
LANGUAGE SQL
EXECUTE AS OWNER
AS
BEGIN
    LET qualified_app_role STRING := 'relationalai.' || :app_role;
    LET query STRING := 'GRANT APPLICATION ROLE IDENTIFIER(?) TO ROLE IDENTIFIER(?)';
    LET rs RESULTSET := (EXECUTE IMMEDIATE :query USING (qualified_app_role, target_role));
    RETURN TABLE(rs);
END;

Grant execute access to the delegated admin role

Grant the delegated Snowflake account role permission to run the procedure:
```
GRANT EXECUTE ON PROCEDURE GRANT_RAI_APP_ROLE(STRING, STRING) TO ROLE ACCOUNTADMIN;
```
Verify the delegation

Inspect the procedure grants to confirm that the delegated role can execute it:
```
SHOW GRANTS ON PROCEDURE GRANT_RAI_APP_ROLE(STRING, STRING);
```

Create a procedure for revoking application roles

Create the revoke procedure

Create a stored procedure that revokes an RAI application role from a Snowflake account role:

CREATE PROCEDURE REVOKE_RAI_APP_ROLE(app_role STRING, target_role STRING)
RETURNS TABLE(STRING)
LANGUAGE SQL
EXECUTE AS OWNER
AS
BEGIN
    LET qualified_app_role STRING := 'relationalai.' || :app_role;
    LET query STRING := 'REVOKE APPLICATION ROLE IDENTIFIER(?) FROM ROLE IDENTIFIER(?)';
    LET rs RESULTSET := (EXECUTE IMMEDIATE :query USING (qualified_app_role, target_role));
    RETURN TABLE(rs);
END;

Grant execute access to the delegated admin role

Grant the delegated Snowflake account role permission to run the procedure:
```
GRANT EXECUTE ON PROCEDURE REVOKE_RAI_APP_ROLE(STRING, STRING) TO ROLE ACCOUNTADMIN;
```
Verify the delegation

Inspect the procedure grants to confirm that the delegated role can execute it:
```
SHOW GRANTS ON PROCEDURE REVOKE_RAI_APP_ROLE(STRING, STRING);
```

Where to go next

Grant user access to give developers the standard RAI account roles.
Operate RelationalAI to manage the app’s SPCS service.