Snowflake introduced Cortex AI Gateway on Tuesday, a centralized management layer designed to manipulate how AI brokers — together with these constructed by opponents like Anthropic's Claude Code and Cursor — entry enterprise knowledge, instruments, and fashions. Alongside the gateway, the corporate unveiled a primary wave of safety integrations with 1Password, Aembit, Linx Security, SailPoint, and Saviynt, an uncommon coalition of id distributors who usually compete with each other, now aligned round a shared belief mannequin for autonomous brokers.
The announcement, created from the corporate's no-headquarters base in Bozeman, Montana, is Snowflake's most aggressive transfer but to place itself not merely because the place the place enterprise knowledge lives, however because the management airplane that decides what AI brokers are allowed to do with it.
"The following period of AI gained't be constructed by means of extra walled gardens. It is going to be constructed by means of safe agent interoperability," Mayank Upadhyay, Snowflake's chief safety and belief officer, instructed VentureBeat in an unique interview. "If each vendor builds a closed ecosystem of brokers, enterprises merely recreate the fragmentation they've spent years making an attempt to unravel. As an alternative of breaking down silos, they create a brand new technology of AI silos that restrict innovation and make it tougher to scale AI throughout the enterprise."
Why decades-old enterprise safety fashions break when AI brokers turn out to be the actors
The core argument animating at this time’s announcement is that many years of enterprise safety structure rests on an assumption that not holds — that the actor behind each entry request is an individual.
"Conventional safety was constructed for a world the place people had been the actors. AI brokers change that fully. For many years, safety fashions assumed folks would entry one software at a time, working at human pace and inside comparatively outlined boundaries," Upadhyay mentioned. The deeper subject, he argued, will not be novelty however publicity: "The problem isn't that AI creates solely new safety issues. It's that AI exposes the blind spots we've at all times had."
Organizations have by no means had excellent visibility into each API, dataset, and workflow, Upadhyay famous, and at human pace these gaps had been manageable. Brokers working at machine pace can "mix entry throughout programs and act on permissions that had been by no means meant to be exercised collectively, amplifying these longstanding dangers." His conclusion: "Within the agentic period, belief can't be a one-time resolution made at login. It needs to be repeatedly verified by means of each agent, each motion, and each interplay throughout the enterprise."
Nancy Wang, chief expertise officer of 1Password, described the failure mode in additional visceral phrases. When brokers first arrived, she instructed VentureBeat, the default sample was dangerously easy: "Let me simply give the agent my credentials and it could actually simply act as me… let's think about you're the top of safety or the top of IT, and you’ve got entry, particularly admin entry, to all the programs. Nicely, now abruptly your agent now has admin entry to all the programs, and so it may exfil knowledge… if it's topic to a immediate injection, for instance."
The audit path turns into equally ineffective, she added: "Think about the audit logs present that Michael despatched a pair million {dollars} to an offshore account… It raises eyebrows when, the truth is, it may simply be an agent going off the rails and doing issues that you simply by no means licensed." Her prescription, and the premise of 1Password's integration with Snowflake, is blunt: "Brokers want their very own id."
Inside Cortex AI Gateway: how Snowflake plans to manipulate agent entry and rein in runaway AI prices
Cortex AI Gateway, which can enter public preview quickly, features as a connective layer for what Snowflake calls "all trusted agent exercise." It governs each first-party brokers constructed inside Snowflake, similar to Snowflake CoWork and CoCo, and third-party brokers constructed on exterior platforms. With help for greater than 100 MCP servers — the Model Context Protocol connectors which have turn out to be the de facto commonplace for wiring brokers to enterprise instruments — the gateway centralizes entry insurance policies, authentication, permissions, and audit logging in a single place.
The gateway additionally addresses a much less glamorous however more and more pressing downside: runaway AI spending. It offers IT and finance groups a unified view of AI consumption, attributes prices to the particular groups, brokers, or workloads driving them, and enforces spending limits earlier than payments spiral.
Upadhyay described how these prices compound in apply. "AI is dynamic. Brokers can invoke a number of fashions, name totally different instruments, and execute multi-step workflows, creating consumption patterns that may change from one activity to the following. For instance, an enterprise could deploy an AI assistant to assist workers reply inner questions. A easy request that solely requires retrieving a doc may unintentionally be routed by means of a dearer reasoning mannequin, set off extra searches throughout a number of programs, or invoke pointless workflows." At scale, with hundreds of workers and lots of of brokers, small inefficiencies turn out to be important line gadgets.
The gateway builds instantly on Snowflake's May 2026 acquisition of Natoma, a 27-person startup whose centralized MCP gateway enforced id, coverage, and audit on the tool-call stage. Forbes reported on the time that the deal — introduced the identical day as Snowflake's $1.33 billion quarterly product income report and a $6 billion AWS compute dedication — was the smallest of the day's three bulletins by greenback worth however probably the most revealing about the place Snowflake believes the following platform combat sits: not within the knowledge warehouse, however within the layer that decides what an agent could contact and information what it did.
Twin attribution and task-scoped entry: the technical blueprint for trusting autonomous brokers
The technical centerpiece of the associate integrations is what Snowflake calls twin attribution. "By logging each the verified non-human id of the agent and the particular human who licensed the duty, we guarantee task-scoped entry and full auditability for each motion taken throughout the enterprise," Upadhyay mentioned. That solutions a query that has stumped safety groups: when an agent takes an motion, whose motion is it? The Snowflake mannequin says the reply is each — the agent's, and the human's who delegated the duty — and each should be recorded.
Job-scoped entry is the companion precept. Relatively than inheriting a consumer's full standing permissions, an agent will get entry solely to what a selected activity requires. Upadhyay acknowledged the plain objection — brokers are dynamic and their subsequent step usually isn't identified upfront. "The objective isn't to foretell each motion an agent will take. It's to make sure that each motion an agent takes is evaluated in actual time in opposition to the suitable insurance policies, scope, contextual indicators, and the unique intent of the consumer," he mentioned.
Wang defined how 1Password's piece works on the protocol stage, pointing to rising requirements like OIDC-A: "the human, for instance, first authorizes the agent to do a selected activity, after which what meaning is the agent will then obtain form of the delegated activity particular token… as a part of that token, that’s the place you be taught of the unique form of delegator id and likewise the intent behind the duty."
The intent-preservation downside is delicate, she famous, as a result of enterprise duties decompose into huge chains of particular person operations. "Once they're accessing a desk, you already know that it's performing on behalf of the unique intent that you simply gave that agent… a activity is perhaps a compilation of lots of, possibly even hundreds, particular person actions." Conserving that intent intact throughout each step within the chain — and flagging the second an agent deviates from it — is what the coalition is in the end making an attempt to standardize.
SailPoint's discipline report: the 3 ways enterprise id programs fail in opposition to AI brokers
Chandra Gnanasambandam, SailPoint's EVP of product and chief expertise officer, introduced the angle of a vendor that has watched enterprises break their id stacks in opposition to this downside for greater than a yr. SailPoint has been within the machine and agent safety marketplace for roughly 18 months, he mentioned, with greater than 100 clients on its agent id product — sufficient of a pattern to catalog the recurring failures.
The primary is scale-driven shallowness. A median Fortune 500 firm has roughly 16,000 workers, and SailPoint is seeing human-to-non-human id ratios of a minimum of 10 to 1 — earlier than counting the instruments and APIs every agent touches, which multiply the rely once more. "You’ll get into 1,000,000 plus non-human identities. Mapping the permissions that every of them get to the 16,000 people is a very non-trivial activity," he mentioned. Most corporations punt, mapping brokers to people on the directory-group stage. "That’s grossly inadequate. You wish to have fantastic grain context. Like I mentioned, it's not entry to Snowflake. It's entry to what column and what knowledge inside Snowflake you want."
The second failure mode is drift. Fashionable fashions are relentless goal-seekers, and that persistence cuts each methods. "If you inform them get this executed, the underlying fashions are so highly effective now. Even the weaker fashions are so highly effective. They are going to go discover a approach to get it executed… They are going to go discover the vulnerabilities to bypass the permission to get it executed," Gnanasambandam warned. The reply, he argued, is runtime monitoring of the whole interplay chain, in contrast repeatedly in opposition to coverage, with automated intervention when an agent escalates past what its human delegator licensed.
The third is lacking knowledge context. Many distributors, he argued, announce splashy integrations with massive software platforms whereas ignoring the place the precise danger concentrates. "That's not the place the danger lies. Threat lies in delicate knowledge, so the small print matter right here… Are you able to map particular columns and rows in Databricks, Snowflake, Redshift, Oracle… into the agent context and the human context? And in the event you can't try this, you’re going to have gaps and holes."
SailPoint's reply required tearing out twenty years of structure. "We rewrote our underlying knowledge and object mannequin to deal with AI id as a first-class object, as a result of for 20 years, SailPoint had a knowledge mannequin and object mannequin that supported the human id, and AI identities are basically totally different," Gnanasambandam mentioned, describing 12 to 18 months of deep engineering work. The result’s what he calls a unified lineage: "From human to grasp agent to sub agent to instrument to software to knowledge. That's what I name the metal chain. That’s in a single knowledge mannequin, one platform."
Why rival id distributors joined Snowflake's coalition — and what all sides will get out of it
Maybe probably the most hanging side of at this time’s announcement is the roster. 1Password, SailPoint, Saviynt, Okta, and Aembit compete for overlapping id and entry budgets. Snowflake satisfied them to construct in opposition to a typical belief framework anyway.
"The rationale we introduced collectively leaders throughout the safety ecosystem is as a result of no single firm can clear up the agent safety problem alone. AI brokers can't ship actual worth in the event that they solely function throughout the boundaries of 1 platform," Upadhyay mentioned. His broader thesis frames the entire technique: "No person needs to exchange knowledge silos with AI silos."
Wang supplied a practical division of labor: "We deliver the belief, and Snowflake brings a system of document." She framed the collaboration as traditional protection in depth — "there are knowledge stage controls, and there are id stage controls, and so collectively we are able to create a a lot stronger ecosystem play."
There’s self-interest within the openness, in fact. Snowflake sits atop an unlimited focus of delicate enterprise knowledge — greater than 13,900 clients, by the corporate's rely — and each third-party agent that touches that knowledge by means of a ruled Snowflake gateway deepens the platform's gravitational pull.
As Constellation Analysis analyst Michael Ni put it when the Natoma deal was introduced, in comments reported by CIO.com: knowledge platforms gained the analytics period, and whoever governs brokers, context, and autonomous actions wins the agentic one. A Forbes analysis of the identical acquisition flagged the strain instantly, noting {that a} governance layer dwelling inside Snowflake dangers pulling MCP's openness again towards a single vendor's management airplane — enticing for Snowflake-standardized outlets, extra awkward for genuinely multi-vendor agent stacks.
Analyst forecasts present agent governance is now a trillion-dollar race in opposition to the clock
The urgency behind at this time’s announcement will not be manufactured. Gartner predicts that by 2027, governance gaps found solely after manufacturing incidents will pressure 40% of enterprises to demote or decommission autonomous AI brokers — with analysts there warning that the best danger an agent poses usually lies not in its output however within the actions it’s empowered to take. IDC, in the meantime, expects greater than 1 billion actively deployed AI agents by 2029, executing roughly 217 billion actions per day, and forecasts agentic AI will exceed $1.3 trillion in worldwide IT spending that yr. The analysis agency's analysts now argue agentic platforms ought to be handled as resolution infrastructure, not productiveness software program.
Towards that backdrop, the id layer is turning into the contested floor, and each main vendor — Salesforce, ServiceNow, Microsoft, Google, Okta — is racing towards the identical runtime-governance chokepoint. Snowflake's differentiator is proximity to the info itself. As Upadhyay put it, safety "can't simply be an API proxy sitting in entrance of an LLM. It has to anchor all the best way down into the underlying knowledge layer, imposing zero-copy boundaries, dynamic knowledge masking, and real-time exfiltration safeguards earlier than an agent ever touches a row of knowledge."
The rollout now strikes to proving floor. Cortex AI Gateway enters public preview quickly, and the 5 associate integrations enter non-public preview, a part Wang described as a deliberate suggestions loop — clients on day one get an agent-access dealer plus "a full audit log that may present you, for instance, what that agent is definitely doing," even when an agent deviates from its intent. Gnanasambandam, characteristically, needs enterprises to skip the simple demos solely, urging clients to deliver loan-origination workflows spanning three clouds and ten functions, half of them mainframes: "Give us that advanced use case and convey anybody on and do it in your context, and we’ll take the problem with anybody on the planet."
That confidence — from a coalition of rivals, no much less — captures what makes this second uncommon. The businesses that spent the final decade preventing over who verifies human id have concluded, kind of concurrently, that the following decade belongs to whoever can confirm the machines performing on our behalf. Upadhyay distilled the wager right into a single line: "The way forward for AI gained't be gained by the organizations with probably the most brokers, however by the organizations that may govern these brokers with probably the most belief, visibility, and management." Within the agentic enterprise, it seems, belief isn't the guardrail. It's the product.
