You can route agent traffic through Snowflake's Cortex AI Gateway and report its spend today, but you cannot yet rely on it to stop prompt injection in third-party agents or hand them approved business definitions. Snowflake announced the package on November 3 at Expedition 2026. Its release notes make gateway inference, observability and cost management generally available. The Guardrails and Business Ontology pieces that make the headline pitch are still ahead of you.
Before you widen agent access on the strength of this launch, check two things: which features your account has today, and how fast the "hard limits" really stop spending.
What You Can Switch On Today
Three parts of the gateway are generally available as of November 3: inference, observability and cost management. Everything else in the announcement carries a lower label, and Snowflake's own pages disagree on some of them. The press release marks Cortex AI Gateway as generally available, while the same-day product blog calls it public preview. The release note resolves that one: the three capabilities above are GA, and Tools "remains in preview."
Statuses below were checked on Snowflake's live pages on November 4, 2026.
| Capability | Status | Where it says so |
|---|---|---|
| Gateway inference, observability, cost management | Generally available | Release note |
| Trace analytics | Preview | Release note |
| Tools (MCP governance) | Public preview, AWS commercial regions only | Tools docs |
| Guardrails on CoCo, CoWork and Cortex Agents | Generally available on all three | April 20 note (CoCo), May 14 note (CoWork, Cortex Agents) |
| Guardrails on gateway traffic, including third-party agents | "Public preview soon" in the release, "public preview" in the blog, absent from the docs | Press release |
| Business Ontology | Private preview, public preview "soon", no date | Engineering post |
| Cortex Sense | Public preview soon | Press release |
| Sandboxes, Abuse Detection, Trace Intelligence, Dynamic Model Routing | Private preview | Press release |
The GA release note does not mention regions. Snowflake's October 8 blog limited the gateway's public preview to AWS commercial regions, with three exclusions, so if you run on Azure or Google Cloud, ask your account team before you plan around it.
How Hard Are the Hard Limits?
The limits work, but they trail the spend, and only one of them enforces anything without extra work from you. The press release says cost governance "enforces hard limits that stop runaway agents before they exceed their budgets." Snowflake's cost documentation is more careful: "usage can pass the limit before the block takes effect."
A per-user quota is the only AI cost control with built-in enforcement, per those docs, and blocks land "within minutes." Snowflake's gateway admin guide puts propagation at about 5 to 10 minutes for most changes and says plainly that "a quota isn't a synchronous hard stop." Quotas also never pool. Ten users on a 100-credit quota can spend 1,000 credits between them.
If you want one ceiling for a team, you need a budget, and a budget is slower. The cost docs say budget actions can take up to eight hours, or up to two with the latency-optimized option. Snowflake's October 29 engineering post gives shorter figures (up to 6.5 hours, or one hour), so plan on the longer ones. A budget does not stop anything by itself either. For Cortex Agents, the resource budget docs have you write a stored procedure that revokes a role's USAGE and attach it to a threshold, and they warn that spending can exceed the threshold during that interval.
The strongest defense of Snowflake's design is that a block within minutes is far better than discovering the overrun on an invoice, and for most workloads it will catch the slow leak. Kargo's VP of Data and AI, Andy Owens, says in the release that the gateway gave the company a spend breakdown "plus hard limits so a runaway process doesn't quietly burn through a budget." That holds for a slow leak. A looping agent with a generous quota and a shared budget can run for hours before the shared ceiling acts, so size the per-user quota as the real brake.
Two coverage gaps belong in your plan. The cost docs list Cortex Analyst and Cortex Fine-tuning as "not supported nor planned" for budget controls, and warehouse time is billed on top of AI consumption.
Can You Charge Spend Back to an Agent?
You can charge spend back to a user today, and per-agent reporting takes more work than the release implies. The release says cost governance attributes spend to "any user, team, department, agent, or app." The October 29 post describes AI_GATEWAY_USAGE_HISTORY recording the authenticated user with credits per request, with teams handled by tagging users into shared budgets. It also says logging must be enabled in the gateway specification, or nothing is recorded.
The admin guide describes no per-agent or per-service limit. Traces get closer to an agent label: the October 8 blog says each record names the client that made the call, down to its version and session. The observability docs list no agent-name field, though, and they keep spend out of the spans and point you to AI_GATEWAY_USAGE_HISTORY for credits. If several agents run under one service user, or one person runs several, test whether the report separates them before you promise finance a per-agent number. Billing has no new meter to learn: the inference docs say gateway inference is billed like Cortex Inference, per token at each model's rate.
Does the Gateway Cover Every Agent?
It covers the agents you route through it. The October 8 blog says calls are recorded when traffic traverses the gateway, and the inference docs say any client that lets you override its base URL can use it, including coding agents, agent frameworks and the official OpenAI and Anthropic SDKs.
An agent holding its own OpenAI or Bedrock key is outside that path. The release says policies apply "across clouds, frameworks, and AI providers," yet the inference docs list Snowflake-served model families and state that "all inference runs within the Snowflake perimeter." They describe no route to a contract you hold directly with a provider. If your agents use those contracts, you will still need something like LiteLLM or an API management gateway for that traffic, or you will have to move it onto Snowflake Cortex AI models.
Tools, the MCP layer that followed the Natoma acquisition, is narrower still. The October 19 release note names CoCo Desktop, CoCo CLI, Claude and Cursor as clients, and only ACCOUNTADMIN can administer MCP servers. The docs describe it as connecting AI clients outward to third-party business tools. The November 3 blog says tool calls are checked against policy before they run, but the Tools docs page does not explain those checks, so ask for them in writing if your CISO is counting on them.
Where Prompt Injection Protection Stops
If your agents run inside Snowflake, protection exists now. If they run outside and pass through the gateway, it does not, according to the docs. The Guardrails page says the feature is "currently available with CoCo, Snowflake CoWork, and Cortex Agents." It requires Enterprise Edition or higher and cross-region inference, an ACCOUNTADMIN turns it on, and it is billed on tokens scanned.
The May engineering post reports no detection or false-positive rates, and the docs concede that "some legitimate prompts may occasionally be flagged." Your own red team will have to supply those numbers. The extension to third-party agents is the promise that matters most for a mixed estate, and it is the one with conflicting labels and no date.
What Business Ontology Will and Won't Do
Business Ontology is a governed record of what a business term means, who approved it and which data assets compute it, and external agents have no described route to it yet. Snowflake's own FAQ says approved definitions are served to agents in CoCo and CoWork. Agents outside Snowflake "can query Semantic Views through Model Context Protocol." The same post mentions import and export in Apache Ossie and RDF, which moves definitions between tools without giving an agent live access.
The evidence for the problem comes from Snowflake's side. The release cites an MIT Technology Review Insights report, sponsored by Snowflake, on a survey of 400 senior data and technology executives run in July and August 2026, in which 55% named missing business context as the primary cause of low-quality agent insights. The design choices look sensible: new concepts start as drafts, stewards approve changes, and agents keep using the approved version until a steward accepts an edit, per the engineering post. That post also says the ontology stores formulas without executing them, so your semantic views still do the calculating and still need their own owners. It reports no accuracy benchmarks. Connectors can start now, since Horizon Context has been in preview since October 12 across AWS and Azure commercial regions.
What to Do Before You Widen Agent Access
This Week:
- Revoke the default
PUBLICgrant on theSNOWFLAKEgateway and grantUSAGEto named roles, as the admin guide describes. We covered the same default-grant problem in CoCo automations. - Turn on logging in the gateway specification, then query
AI_GATEWAY_USAGE_HISTORYto confirm rows appear.ALTER AI GATEWAY ... FROM SPECIFICATIONreplaces the whole specification, so keep the full file in version control. - Replace any
'*'model wildcard with a named list. The October 29 post says a wildcard exposes every model the account can access and provides no cost ceiling. - Enable advanced prompt injection Guardrails if you run Cortex Agents, CoCo or CoWork on Enterprise Edition, and review the flagged requests in
CORTEX_AI_GUARDRAILS_USAGE_HISTORYfor false positives.
This Month:
- Set per-user quotas below your true stopping point, because blocks land after the spend. Then run a test agent in a loop and measure the actual overshoot on your account.
- Inventory which agents bypass the gateway with their own provider keys. Give each one an owner and a decision: move it, or govern it elsewhere.
- Have your security lead get three things from Snowflake in writing: the Guardrails date for gateway traffic, the regions covered by the GA, and how Tools policy checks work.
Before Your Next Agent Rollout:
- Name owners for your 20 most disputed metrics, and start with the ones finance and sales define differently. That work pays off with or without the ontology, and any glossary import will enter review by those same owners.
- Require a label for every agent answer that touches a governed metric. The engineering post's "governed", "derived" and "exploratory" labels are a usable template, whichever tool you end up on.
The Bigger Picture
Every large platform now wants to be the single policy point for agents, and none has finished. Databricks announced Unity AI Gateway upgrades on June 16 that promise to "automatically stop requests when budgets are exceeded," with Contextual Service Policies in beta. Salesforce's AI Control Plane claims reach across "Salesforce and third-party AI," with new capabilities rolling out from early fiscal 2028 and pricing to follow. If you are choosing between data platforms, compare the documented enforcement delay and the coverage of traffic you do not route through them, because the announcements read alike.
Snowflake's GA pieces are worth using now if your agents already call Cortex models: the docs describe no separate gateway fee, and the traces land in tables you can query with SQL. Hold the wider access decision until Guardrails for gateway traffic appears on the docs page, which today lists three surfaces and leaves the gateway out.
Continue Reading
- AI Agents Have Admin Access. 57% of Firms Aren't Ready.
- Snowflake Agents Run as All Your Roles. Revoke From PUBLIC.
- Best LLM Gateways for Cost Control: Self-Host First
- AI Gateway vs API Management: No Managed Gateway Caps Your Spend
- Snowflake Alternatives: Fix the AI Bill Before You Move a Table
- Snowflake Copilot vs Genie vs ThoughtSpot: Copilot Is the Wrong Tool