Snowflake makes partial answers the default when Cortex Agents lose a tool
The September 2 behavior change preserves role-based access, but moves a missing grant from an HTTP failure into the answer stream — so clients must treat warnings as part of correctness.
Snowflake is changing how Cortex Agents and Snowflake CoWork behave when a caller cannot access every tool configured on an agent. Starting September 2, 2026, the default is to continue with the tools the caller’s role can use, return an answer, and emit a warning for each inaccessible tool. Snowflake says the change applies to agent runs through REST, SQL and CoWork conversations. Snowflake’s behavior-change notice
From hard failure to degraded execution
Previously, a missing privilege on a configured Cortex Search, Cortex Analyst, MCP or skill tool caused the request to stop at the first inaccessible tool with an HTTP 4XX response. Under the new default, the run returns HTTP 200 and proceeds with a smaller tool set. Streaming clients receive a response.warning event with code 399569; final REST responses and SNOWFLAKE.CORTEX.DATA_AGENT_RUN JSON place the warning in a top-level warnings array. Snowflake documents the before-and-after behavior
The security boundary does not change: Snowflake says no privilege is added, and callers still need the same grants to use each tool. What changes is the failure contract. One agent can now serve roles with different privileges without requiring a separate agent for each privilege class, but an apparently successful response may have been produced without a data source or analytical tool that the developer expected. Snowflake’s stated rationale and impact
Warnings become part of answer quality
For text-to-SQL systems, that makes warning handling a correctness concern rather than just an observability detail. A client that previously surfaced missing grants by catching HTTP errors will no longer see that signal. Snowflake explicitly tells developers to subscribe to response.warning and handle code 399569; the warning is also written to SNOWFLAKE.LOCAL.AI_OBSERVABILITY_EVENTS for later audit. Snowflake’s client guidance
Teams that prefer fail-closed behavior can set orchestration.tool_not_accessible to reject, which returns one error listing every inaccessible checked tool, or to legacy, which preserves first-failure behavior. The new accept mode is the default when the field is unset. Snowflake notes that committed agent versions are immutable, so changing a versioned agent requires creating and committing a new version and repointing its default version or alias. Configuration and migration steps
The practical migration test is straightforward: inventory clients that equate HTTP 200 with a complete tool run, exercise each supported caller role against the agent specification, and decide whether a partial answer is safe for that use case. For informational assistants, degradation may be useful. For regulated or decision-driving analytics, reject may remain the clearer contract until the application can display and act on tool-access warnings.
sources
comments · 0