Set up RelationalAI in Snowflake

RelationalAI (RAI) runs inside your Snowflake account as a native app, so your data never leaves your account. This guide takes a Snowflake administrator through the first-time setup: request access to the RAI native app, install and activate the app, grant user access, and hand off connection details to developers.

Estimated setup time

20–30 minutes

Prerequisites

• A Snowflake account and the ORGADMIN or ACCOUNTADMIN role.
• A query warehouse for developers. An X-SMALL size is fine. Create one if you don’t already have it.

Review installation impact

Before you request access, review the privileges the app requires, the resources it creates, and its impact on your Snowflake costs.

What access does the app receive?

Required privileges

Snowflake grants these privileges when you install the app. You cannot revoke them while the app is installed.

• Run automated data workflows.

  Privileges:

  EXECUTE TASK · EXECUTE MANAGED TASK

• Create and manage the app’s dedicated warehouse.

  Privileges:

  CREATE WAREHOUSE

• Create compute pools for RAI workloads.

  Privileges:

  CREATE COMPUTE POOL

• Expose a secure endpoint for authenticated client connections.

  Privileges:

  BIND SERVICE ENDPOINT

Optional privilege

This privilege is not included at installation. Grant it only if you use a feature that integrates with Snowflake Cortex.

• Enable Snowflake Cortex integrations.

  Privileges:

  IMPORTED PRIVILEGES ON SNOWFLAKE DB

Security boundaries

• Data: Installation does not grant blanket access to existing tables or views. You configure data sources separately, and Snowflake checks object-level privileges when they are accessed through RAI.
• Users: You choose who can use the app by granting RAI application roles to Snowflake account roles.
• Connections: The service endpoint accepts authenticated client connections. Connected users still need the required RAI roles and Snowflake grants. External clients use the public internet unless Private Link is configured.

Check row access and masking policies before sharing sensitive data. RAI evaluates these policies against a shared RELATIONALAI role, not each user’s configured role. Review how Snowflake access control is handled.

What resources and costs should I expect?

Cost overview

RAI costs depend on how much storage and compute you use. Snowflake charges for both. RelationalAI adds a surcharge only to compute used by reasoners.

The sections below show what the app creates and when each resource can incur charges. Review the cost model with whoever approves Snowflake spend before you install.

For more, see Understand and optimize costs.

Application footprint

Installation creates the application database. You then activate the app to start its services and managed compute. Activating the app adds the service, warehouse, and compute pools that run it.

• Application database

  Snowflake creates this application object during installation, and it remains when you deactivate the app. Snowflake charges a small amount to store it, and RelationalAI adds no surcharge.

  Resources:
  RELATIONALAI
• Snowflake virtual warehouse

  Activating the app creates this virtual warehouse for Snowflake operations. Snowflake charges for compute while the warehouse runs. RelationalAI doesn’t add a surcharge.

  Resources:
  RELATIONAL_AI_ERP_WAREHOUSE

  X-SMALL

• Compute pools for app operations

  Activating the app creates these compute pools to support its core operations. The pool objects don’t incur charges. Snowflake charges for compute running in them. RelationalAI doesn’t add a surcharge.

  Resources:
  RELATIONAL_AI_ERP_COMPUTE_POOL

  CPU_X64_XS · AWS and Azure

  RELATIONAL_AI_COMPILE_CACHE_SPCS

  HIGHMEM_X64_M · AWS and Azure

• App service in Snowpark Container Services

  Activating the app creates a managed service in Snowpark Container Services to run RelationalAI inside your Snowflake account. Its usage is included in the app’s compute pool charges. RelationalAI doesn’t add a surcharge.

Compute pools for reasoners

Reasoners run logic, prediction, and optimization workloads. Activating the app creates the compute pools they can use. Available sizes differ between AWS and Azure.

• Standard compute for reasoners

  Runs logic, prediction, and optimization workloads. Snowflake charges for compute while reasoners run and for any reserved nodes. RelationalAI adds a surcharge only while reasoners run.

  Resources:
  RELATIONAL_AI_HIGHMEM_X64_S

  AWS and Azure

  RELATIONAL_AI_HIGHMEM_X64_M

  AWS and Azure

• High-memory compute by cloud

  Provides larger high-memory options where each cloud supports them. Larger sizes cost more per hour. Snowflake charges while reasoners run and for any reserved nodes. RelationalAI adds a surcharge only while reasoners run.

  Resources:
  RELATIONAL_AI_HIGHMEM_X64_L

  Logic and prediction workloads · AWS only

  RELATIONAL_AI_HIGHMEM_X64_SL

  Logic workloads · Azure only

• Compute with GPUs for prediction workloads

  Runs prediction workloads on GPU instances. Snowflake charges for compute while reasoners run and for any reserved nodes. RelationalAI adds a surcharge only while reasoners run.

  Resources:
  RELATIONAL_AI_GPU_NV_S

  AWS only

  RELATIONAL_AI_GPU_NV_SM

  Azure only

• CPU pools for future use

  Current workloads don’t use these pools. The pool objects don’t incur charges. Snowflake charges only if you reserve nodes. RelationalAI doesn’t add a surcharge while the pools are unused.

  Resources:
  RELATIONAL_AI_CPU_X64_S

  AWS and Azure

  RELATIONAL_AI_CPU_X64_M

  AWS and Azure

When charges apply

• Installation: Creates the application database. Snowflake charges a small amount to store it.
• Activation: Adds the other resources listed here and starts the app’s managed compute. Snowflake can begin charging for compute.
• Idle compute pools: A pool with no reserved nodes and no running reasoners doesn’t incur compute charges.
• Deactivation: Deactivating the app suspends the app service, warehouse, and compute pools, reducing most compute charges. The application database continues to incur storage charges, and some background tasks may continue to use a small amount of compute.

For the complete resource inventory and commands to inspect each resource, see Resources the app creates.

Request app access

RAI is available on the Snowflake Marketplace, but you must request access before you can install and activate it:

1. Sign in to Snowsight as an ORGADMIN or ACCOUNTADMIN.

2. Open the RelationalAI Marketplace listing. Click the Get button then fill out and submit the access request form.

3. Wait for RelationalAI to enable access. A representative notifies you when the app is available to install.

Install and activate the app

Once access to the app is enabled, follow these steps to install the app in your Snowflake account:

1. In Snowsight, go to Catalog > Apps. RelationalAI appears under Recently shared with you.

2. Click Buy, review the pricing dialog, and confirm. The app installs into your account as the RELATIONALAI application database.

3. Wait for the INSTALLED column to show that installation finished.

4. Run the following SQL as ACCOUNTADMIN in a new worksheet:

   -- Check you're an admin who can install apps and grant
   -- account privileges, and that the RELATIONALAI app exists.
   USE ROLE ACCOUNTADMIN;
   SHOW APPLICATIONS LIKE 'RELATIONALAI';
   
   -- Start the app. The first activation sets up compute and
   -- can take a few minutes.
   CALL RELATIONALAI.APP.ACTIVATE();
   
   -- Check the services. Wait a few minutes and rerun this line
   -- until every service shows READY.
   CALL RELATIONALAI.APP.SERVICE_STATUS();
   
   -- Turn on change data capture (CDC), then confirm it's on.
   CALL RELATIONALAI.APP.RESUME_CDC();
   CALL RELATIONALAI.APP.CDC_STATUS();

   Tip

   If activation fails with an error about the account parameter PREVENT_UNLOAD_TO_INTERNAL_STAGES, that setting is blocking the app from writing to its internal stage. See Fix app activation errors caused by settings in your Snowflake account for the fix, then activate again.

Grant user access

You’ll grant users access in two steps:

1. Use the form below to generate SQL for the users you specify, then run it in Snowflake. The SQL grants them access to the RAI Native App and its service endpoint.
2. Create an invite link for each user you granted access to. Each link opens the Start building with PyRel guide with that user’s connection values pre-filled. Users can copy the values into their project configuration. Invite links contain no secrets, so you can share them safely. Deliver any required secrets separately and securely.

Tip

You can return to this section to prepare access for more users.

Step 1: Generate and run user access SQL

Choose the access settings, review the generated SQL, and run it as ACCOUNTADMIN.

1. Choose a warehouse

   Choose an existing warehouse for developer queries. The generated SQL grants all users access to this warehouse.

   Warehouse

   Developer queries run on this warehouse. An X-SMALL warehouse is sufficient.

2. Choose authentication

   Choose how developers sign in to Snowflake. OAuth is the standard choice for development and other non-production workloads. The selected method changes the generated SQL.

   OAuth browser sign-inRecommended for most developers. PyRel temporarily starts a local callback server during sign-in using the callback URL below to handle the OAuth redirect.

   Programmatic access tokenFor headless scripts. Set a network policy for your environment, deliver each token securely, and rotate tokens before they expire.

   JWT key pairFor automation managed with per-user key pairs. Ask each developer to send you their public key, then add it below so the setup SQL can register it in Snowflake.
3. Assign users and roles

   Add each Snowflake user who needs access and select at least one role. Users assigned Developer also get an invite link to share in the next step.

   What does the Developer role allow?

   Select Developer for people who build and run PyRel models. The generated SQL creates the RAI_DEVELOPER Snowflake role and grants it the RELATIONALAI.RAI_USER application role.

   Developer access lets them:

   • Use the RAI Native App to run PyRel queries against semantic models.
   • Use, create, and delete reasoners.
   • Create and manage data streams for data used by RAI models.

   Snowflake permissions are separate

   Developer access does not grant access to Snowflake warehouses, tables, or views. Grant those privileges separately.

   What does the Admin role allow?

   Select Admin for people who configure and operate the RAI Native App. The generated SQL creates the RAI_ADMIN Snowflake role and grants it the RELATIONALAI.ALL_ADMIN application role.

   Admin access includes all RAI application roles. It lets them:

   • Manage the RAI Native App and its service in Snowpark Container Services.
   • Manage RAI resources, including reasoners, data streams, and model data resources.
   • View app billing and consumption data, as well as sensitive logs.

   Snowflake permissions are separate

   Admin access does not grant access to Snowflake warehouses, tables, or views. Grant those privileges separately.

   Admin access is broad

   Admin access includes every RAI application role, including access to sensitive logs and billing data. To limit access, follow the custom account role workflow. This guide doesn't cover custom roles.

   User 1

   Snowflake username for user 1

   Access roles

   Developer Admin

   Add user

4. Review and run the SQL

   Review this SQL, then copy it and run it as ACCOUNTADMIN in a new Snowflake worksheet. Before you send the developer handoffs, review each statement's result and resolve any errors.

   user-access.sql

   -- Personalized RelationalAI user access script.
   -- Run the activation script first, then run this script as ACCOUNTADMIN in Snowsight or SnowSQL.
   -- Creates the selected roles, grants user access, and configures the selected Direct Access authentication method.
   
   -- Create the standard Snowflake roles. Each one receives the
   -- matching RelationalAI application role. Existing roles are left unchanged.
   CREATE ROLE IF NOT EXISTS RAI_ADMIN;
   GRANT APPLICATION ROLE RELATIONALAI.ALL_ADMIN TO ROLE RAI_ADMIN;
   
   CREATE ROLE IF NOT EXISTS RAI_DEVELOPER;
   GRANT APPLICATION ROLE RELATIONALAI.RAI_USER TO ROLE RAI_DEVELOPER;
   
   -- Grant each user the selected RAI_DEVELOPER or RAI_ADMIN role.
   
   -- Grant both standard roles access to an existing warehouse.
   -- Use a warehouse your account already has. This script does not create one.
   GRANT USAGE ON WAREHOUSE <warehouse_name> TO ROLE RAI_DEVELOPER;
   GRANT USAGE ON WAREHOUSE <warehouse_name> TO ROLE RAI_ADMIN;
   
   -- Check that the roles and users got the grants above.
   SHOW GRANTS TO ROLE RAI_DEVELOPER;
   SHOW GRANTS TO ROLE RAI_ADMIN;
   SHOW GRANTS TO USER <user_name>;
   
   -- Direct Access with OAuth: interactive browser sign-in.
   -- The redirect URI must be plain-HTTP localhost, because the RAI
   -- Python client finishes sign-in on a local callback with no TLS.
   -- Keep this value only for that localhost callback.
   CREATE SECURITY INTEGRATION RAI_DIRECT_ACCESS_OAUTH
     TYPE = OAUTH
     ENABLED = TRUE
     OAUTH_CLIENT = CUSTOM
     OAUTH_CLIENT_TYPE = 'PUBLIC'
     OAUTH_REDIRECT_URI = 'http://localhost:54321/snowflake/oauth-redirect'
     OAUTH_ALLOW_NON_TLS_REDIRECT_URI = TRUE
     OAUTH_ENFORCE_PKCE = TRUE
     OAUTH_ISSUE_REFRESH_TOKENS = TRUE
     OAUTH_REFRESH_TOKEN_VALIDITY = 86400
     ALLOWED_ROLES_LIST = ('RAI_ADMIN', 'RAI_DEVELOPER');

   What should I verify after I run the script?

   • Review each statement result and resolve errors before sharing a handoff.
   • Confirm the generated role and user grants with the script's SHOW GRANTS queries.
   • For OAuth, copy the client ID from DESC SECURITY INTEGRATION. For PAT, record each displayed token in your secret manager. For JWT, confirm the registered key fingerprint.

   Before rerunning the script, review any roles, schemas, network policies, tokens, key pairs, or OAuth integrations that use the names in the generated SQL. Depending on the statement, a rerun may leave an existing object unchanged, replace its settings, or fail.

Step 2: Complete developer handoffs

After you run and verify the Step 1 SQL, add the connection values developers need. Then send each user assigned Developer their invite link.

1. Add the account identifier

   Developers need the account identifier to connect to the Snowflake account where you installed RelationalAI.

   Run this SQL, then paste the output below:

   SELECT CURRENT_ORGANIZATION_NAME() || '-' || CURRENT_ACCOUNT_NAME() AS account_identifier;

   Account identifier

   Use the returned value as-is, including its region segment. When you select PrivateLink, the generated developer config adds the .privatelink suffix.

2. Configure PrivateLink if required

   Complete this step only when developers must connect through Snowflake PrivateLink.

   Use PrivateLink for developer connections
3. Send developers their invite links

   After you complete the required values, copy each invite link and send it to the developer. Each link opens the Start building with PyRel guide with that developer's connection values filled in.

   No developer invite links yet

   Return to Step 1 and assign at least one user the Developer role to create an invite link.

Shut down the app (Optional)

If you set up the app only to evaluate it and no longer need it running, stop it to reduce ongoing Snowflake compute costs. Run this SQL as ACCOUNTADMIN:

CALL RELATIONALAI.APP.DEACTIVATE();

APP.DEACTIVATE() suspends the app service, warehouse, compute pools, and CDC. It also deletes reasoners and cancels in-progress jobs.

Caution

The app doesn’t reactivate automatically. An administrator must start the app again before developers can use PyRel.

Note

Deactivation reduces most compute costs, but it doesn’t uninstall the app. The application database continues to incur storage charges, and diagnostic and billing tasks can still use a small amount of Snowflake compute. See Shut down the app for more aggressive cost-saving options.

Where to go next

After setup, use these guides to operate the RAI Native App and its resources:

OverviewLearn how the RAI Native App works and how to administer it.Native AppCheck status, configure, and troubleshoot the RAI Native App.Data sourcesManage RelationalAI's access to your Snowflake data.ReasonersMonitor and manage the reasoning engines that evaluate PyRel queries.