Snowflake CoWork can now turn analysis into files—but the export path changes the agent’s security model

Snowflake has made document generation in CoWork generally available, letting an analyst turn a conversation into a PDF, Word document, PowerPoint deck or HTML file and inspect the result inline. The feature sounds like an output-format upgrade. Operationally, it is also a change to the agent’s execution surface: Snowflake says document generation only works when the associated Cortex Agent has its code execution tool enabled.

The export is a code workload

According to Snowflake’s GA notice, CoWork assembles each file through the Cortex Agent code execution tool. The document-generation guide says the agent can reuse the conversation context and its configured data tools, and that user or agent skills can override built-in behavior—for example, by enforcing a standard deck structure or company template.

That means teams should not treat “generate a deck” as a cosmetic final step. It invokes an execution environment. Snowflake’s code-execution documentation says the sandbox is isolated from direct warehouse access and can work only with data passed into the session plus mounted workspace content. SQL retrieval happens through the agent’s SQL tools outside the sandbox.

Three controls need review

First, the sandbox can read and write the user workspace stage. Files written there persist after the sandbox suspends, even though in-memory state does not. Teams therefore need retention and access rules for generated files, not just for the chat that produced them.

Second, Snowflake says code execution is unavailable when an agent is invoked through an owner’s-rights stored procedure; the tool is removed from the request and the response includes a warning. A workflow that succeeds interactively under caller’s rights can therefore fail when wrapped in a privileged automation path.

Third, state-changing sandbox tools use an always_ask approval policy by default, but administrators can change that policy to always_allow. Snowflake explicitly recommends skipping confirmation only for trusted automated workflows. That setting deserves a separate review from the agent’s warehouse privileges because it governs what the execution environment may do, not what SQL the agent may query.

The practical rollout checklist is short: enable code execution only on the agents that need exports, test the actual caller-rights path, decide where generated files may persist, and keep confirmation enabled unless automation genuinely requires otherwise. GA removes the preview label; it does not remove those control-plane decisions.