Skip to main content

Snowflake User-Level Connector with RBAC Integration

Overview​

This guide explains how to set up a Snowflake connector with Role-Based Access Control (RBAC) and use it from a Custom Chatbot. Each user authenticates individually with Snowflake, and every query runs with that user's own Snowflake roles, so data access is always governed by their assigned permissions.

Snowflake is a database user connector: it is used through a Custom Chatbot and is not a direct chat tool for RouteLLM.

Prerequisites​

  • Access to Snowflake with appropriate permissions
  • An Abacus.AI account with organization-level access
  • Understanding of Snowflake RBAC concepts (databases, users, roles)

How it works​

  1. An organization admin creates a Snowflake connector at the organization level with RBAC enabled.
  2. A developer trains a Custom Chatbot on that connector as an External Database.
  3. Each end user signs in to Snowflake on their first question. Abacus.AI stores the session for that user only.
  4. All subsequent queries execute with the user's own Snowflake roles.

Step 1 — Create the RBAC-enabled Snowflake connector​

Create a Snowflake connector at the organization level following the RBAC Flow for Snowflake documentation. Make sure it includes the database, warehouse and role details your users need, then click Verify Now and confirm the connector is active.

Step 2 — Build a Custom Chatbot on the connector​

Follow Use a database connector in a Custom Chatbot: create a Custom Chatbot project, train the model with Structured data source → External Databases and select the Snowflake connector from Step 1, then deploy and test it.

Selecting External Databases as the structured data source

Step 3 — End-user sign-in​

When a user enters their first question, they are prompted to log in to Snowflake with their own credentials. Once authenticated, the chatbot answers using only the data that user's Snowflake roles can see. The user's Snowflake connection appears alongside their other user-level connectors.

Security considerations​

  • User-level authentication: each user must authenticate individually with their Snowflake credentials.
  • Permission inheritance: users can only access data according to their assigned Snowflake roles.
  • Session management: authentication sessions are managed securely between Abacus.AI and Snowflake.

Best practices:

  1. Role assignment: ensure users have the appropriate roles assigned in Snowflake before they use the chatbot.
  2. Database permissions: verify that the connector's configured database, schema and warehouse are accessible to those roles.
  3. Monitoring: regularly review Snowflake access history and query logs for compliance.
  4. Updates: keep the connector configuration current as organizational roles and permissions change.

Troubleshooting​

  • Authentication failures: verify the user's Snowflake credentials and role assignments.
  • Data access errors: check RBAC permissions for the specific user, database and schema.
  • Connector issues: ensure the Snowflake connector configuration includes all necessary database and role details, and that it verifies successfully.
  • Refer to the Snowflake RBAC documentation for permission management, and contact support@abacus.ai for platform-specific issues.