Snowflake permissions

Run frontier setup snowflake for a GRANT template personalized from your dbt profile. Do not use ACCOUNTADMIN.

frontier setup snowflake
frontier setup snowflake --cdc
frontier setup snowflake --query-history

The default PR-assessment role may:

• Use a warehouse and the project database/schema
• SELECT source and model relations used by the compiled graph
• Create temporary key tables in a dedicated work schema (default FRONTIER_WORK)

It must not INSERT, UPDATE, or DELETE production marts. Frontier refuses to execute against identifiers named like DBT_PROD, PROD, PRODUCTION, or ending in _PROD.

--cdc adds SELECT on tables and streams in a CDC schema (default FRONTIER_CDC). Include those grants only when you run the separate CDC data-change workflow. --query-history is optional and disabled unless requested.

Apply the SQL as a security administrator, then use ROLE FRONTIER_PR_ASSESSOR (or the role you renamed) in CI. Never paste real account locators, passwords, or customer identifiers into documentation or Git.