Snowflake on Tuesday announced Cortex AI Gateway, a centralized control layer intended to govern how AI agents — including third‑party offerings such as Anthropic’s Claude Code and Cursor — access enterprise data, tools, and models. At the same time, Snowflake revealed initial security integrations with identity providers 1Password, Aembit, Linx Security, SailPoint, and Saviynt, a notable coalition of competitors aligning on a shared trust model for autonomous agents.
Positioning Snowflake as the agent control plane
Announced from Snowflake’s no‑headquarters base in Bozeman, Montana, the move is the company’s most assertive effort to be more than a data repository: Snowflake aims to be the control plane that decides what agents may do with corporate data.
Mayank Upadhyay, Snowflake’s Chief Security and Trust Officer, told VentureBeat that secure agent interoperability — not more walled gardens — will define the next AI era. He warned that if every vendor builds closed agent ecosystems, enterprises will recreate fragmentation and new AI silos that impede innovation and scale.
Why legacy security assumptions fail with agentic actors
Snowflake’s argument is that decades of enterprise security assumed a human was the actor behind access requests. Upadhyay explained that AI agents change that model: agents operate at machine speed, can combine permissions across systems, and may exercise permissions together that were never intended to be used in combination. Those dynamics amplify long‑standing visibility gaps.
Nancy Wang, Chief Technology Officer of 1Password, described a dangerous default pattern: giving an agent a user’s credentials effectively lets it act as that user — potentially granting admin access across systems, enabling exfiltration or actions caused by prompt injection. Audit logs may then show an authorized human performed an action (for example, a large transfer) when in fact an agent deviated from intent. Wang’s answer, and the rationale for 1Password’s integration with Snowflake, is clear: agents need their own identities.
What Cortex AI Gateway does and how it addresses runaway costs
Cortex AI Gateway, which will enter public preview soon, acts as a connective layer for what Snowflake calls “all trusted agent activity.” It governs both first‑party agents built inside Snowflake (such as Snowflake CoWork and CoCo) and third‑party agents built on external platforms. With support for more than 100 Model Context Protocol (MCP) servers — the connectors commonly used to wire agents to enterprise tools — the gateway centralizes access policies, authentication, permissions, and audit logging.
The gateway also tackles uncontrolled AI spending by giving IT and finance teams a unified view of AI consumption, attributing costs to the teams, agents, or workloads that generate them, and enforcing spending limits before bills escalate. Upadhyay illustrated how dynamic agent behavior can route simple requests through expensive reasoning models, trigger additional searches across systems, or invoke unnecessary workflows — inefficiencies that scale into material costs across thousands of users and hundreds of agents.
The gateway builds on Snowflake’s May 2026 acquisition of Natoma, a 27‑person startup whose centralized MCP gateway enforced identity, policy, and audit at the tool‑call level. At the time, analysts noted that while the deal was small relative to other announcements, it signaled Snowflake’s bet that the next platform fight will center on who governs what agents can touch and records what they do.
Dual attribution and task‑scoped access: the technical blueprint
A central technical feature of the partner integrations is “dual attribution.” Snowflake logs both the verified non‑human identity of the agent and the specific human who authorized the task, providing task‑scoped access and full auditability for each action. This answers the question security teams face: when an agent acts, whose action is it? Snowflake’s model records both the agent’s identity and the delegating human.
Task‑scoped access complements dual attribution. Rather than inheriting a user’s full privileges, an agent receives only the access required for a specific task. Upadhyay acknowledged that agents are dynamic and next steps are often unknown; the objective is not to predict every action but to evaluate each action in real time against policies, scope, contextual signals, and the user’s original intent.
1Password’s Wang described protocol‑level mechanics and emerging standards such as OIDC‑A: the human authorizes an agent for a specific task, the agent receives a delegated, task‑specific token that carries the delegator’s identity and the task intent. Because enterprise tasks can decompose into hundreds or thousands of operations, preserving intent across the chain and flagging deviations is a subtle but crucial challenge the coalition aims to standardize.
SailPoint’s field report: three recurring identity failures against agents
Chandra Gnanasambandam, SailPoint’s EVP of Product and CTO, shared lessons from the vendor’s roughly 18 months in the agent identity market and a customer base exceeding 100 for that product. He highlighted three recurring failure modes:
- Scale‑driven lack of granularity: A typical Fortune 500 has about 16,000 employees, and SailPoint sees human‑to‑non‑human identity ratios of at least 10:1. Once tools and APIs are counted, organizations can reach millions of non‑human identities, making fine‑grained permission maps difficult. Coarse mappings to directory groups are insufficient when access should be column‑ and row‑level.
- Drift and persistence: Modern models will relentlessly pursue goals and may find ways to bypass permissions. The remedy is runtime monitoring across the entire interaction chain, continuously comparing behavior to policy and automatically intervening when an agent escalates beyond its human delegator’s authorization.
- Missing data context: Many vendors announce broad application integrations but ignore where real risk concentrates — in sensitive data. Organizations need the ability to map specific columns and rows across storage systems (Databricks, Snowflake, Redshift, Oracle, etc.) into both agent and human contexts to avoid gaps.
To address this, SailPoint rewrote underlying data and object models to treat AI identity as a first‑class object, creating a unified lineage from human to master agent to sub‑agent to tool to application to data.
Why competing identity vendors joined the Snowflake coalition
The integration roster is notable: 1Password, SailPoint, Saviynt, Okta, and Aembit — companies that compete for overlapping identity and access budgets — agreed to build against a common trust framework. Upadhyay said no single company can solve agent security alone and that agent value depends on cross‑platform interoperability. Nancy Wang framed the partnership pragmatically: 1Password provides the trust layer while Snowflake provides the system of record; together they form defense‑in‑depth.
There is commercial incentive too: Snowflake hosts a large concentration of sensitive enterprise data — the company cites more than 13,900 customers — and every third‑party agent governed through Snowflake’s gateway increases the platform’s pull. Analysts have argued that whoever governs agent context and autonomous actions will dominate the agentic era, though some cautioned that embedding a governance layer inside Snowflake risks steering MCP openness toward a single vendor control plane.
Analyst forecasts and the race to govern agents
Research underscores the urgency. Gartner predicts that by 2027 governance gaps discovered after production incidents will force 40% of enterprises to demote or decommission autonomous AI agents. IDC expects more than 1 billion actively deployed AI agents by 2029, executing roughly 217 billion actions per day, and forecasts agentic AI will exceed $1.3 trillion in worldwide IT spending that year. IDC now treats agentic platforms as decision infrastructure rather than productivity tools.
Against this backdrop, the identity layer is contested ground: major vendors including Salesforce, ServiceNow, Microsoft, Google, and Okta are racing toward runtime governance chokepoints. Snowflake emphasizes that security must anchor down into the underlying data layer — enforcing zero‑copy boundaries, dynamic data masking, and real‑time exfiltration safeguards — not merely sit as an API proxy in front of an LLM.
Next steps: previews, customer tests and proving the model
Cortex AI Gateway will enter public preview soon; the five partner integrations begin in private preview. Snowflake says the initial customer experience will include an agent‑access broker and a full audit trail showing what an agent is doing, including deviations from intent. SailPoint’s Gnanasambandam urged customers to test complex, real‑world workflows across multiple clouds and legacy systems to validate the platform in context.
The unusual coalition of rival identity vendors and Snowflake’s emphasis on governance capture why this moment is distinct: companies that previously competed over human identity verification now agree the coming decade will belong to those who can verify and govern the machines acting on our behalf. As Upadhyay summarized: “The future of AI won’t be won by the organizations with the most agents, but by the organizations that can govern those agents with the most trust, visibility, and control.”
