The fastest way to unblock an AI agent is to grant it a wide role and move on. The role works, the agent runs, and you have just handed an unattended process reach across half your warehouse. Least-privilege access is the opposite trade: a little more setup now for a much smaller blast radius when something goes wrong.
Two grants, two outcomes. A broad standing role reaches everything, forever, attributed to a shared account. A least-privilege grant reaches one schema, for the task, attributed to one agent. The first is convenient. The second is the one you can defend when an agent does something unexpected at 3am.
Broad standing grants versus scoped per-task access
A broad grant answers every future request the agent might make, which is exactly the problem: it also answers requests you never intended. Least-privilege access narrows the grant to the task in front of the agent, so the worst an over-eager or compromised agent can do is bounded by a role that barely reaches past its job.
For agents this matters more than for people. A person with too much access usually uses a fraction of it. An agent will use whatever it holds the moment a task calls for it, so the scope of the grant is the scope of the risk.
Snowflake's role hierarchy is where over-grant sneaks in. Roles inherit, so granting an agent a role that sits high in the hierarchy quietly hands it everything below. It is easy to attach an agent to an existing analyst or engineer role because that role "already has what it needs," and now the agent has everything those humans accumulated over years. Least-privilege access means building a fresh, flat role for the agent rather than borrowing one that inherits broadly. The role should grant the warehouse usage and the specific schema reads the task requires, with nothing above it in the tree.
The gateway adds the second half. Even a narrow role is a standing capability; pairing it with scoped, recorded sessions means the agent's reach is small and what it does inside that reach is attributed and reviewable. Narrow the role, then govern the session, and the blast radius stays bounded on both axes.