Snowflake Cortex AI Gateway Aims to Govern AI Agents and Stop Runaway Enterprise Costs

Snowflake launches Cortex AI Gateway to control AI agents and prevent runaway enterprise costs

Snowflake announced Cortex AI Gateway on Tuesday, a centralized control layer designed to govern how AI agents -- including those built by competitors like Anthropic's Claude Code and Cursor -- access enterprise data, tools, and models. Alongside the gateway, the company unveiled a first wave of security integrations with 1Password, Aembit, Linx Security, SailPoint, and Saviynt, an unusual coalition of identity vendors who often compete with one another, now aligned around a shared trust model for autonomous agents. The announcement, made from the company's no-headquarters base in Bozeman, Montana, is Snowflake's most aggressive move yet to position itself not merely as the place where enterprise data lives, but as the control plane that decides what AI agents are allowed to do with it. "The next era of AI won't be built through more walled gardens. It will be built through secure agent interoperability," Mayank Upadhyay, Snowflake's chief security and trust officer, told VentureBeat in an exclusive interview. "If every vendor builds a closed ecosystem of agents, enterprises simply recreate the fragmentation they've spent years trying to solve. Instead of breaking down silos, they create a new generation of AI silos that limit innovation and make it harder to scale AI across the business." Why decades-old enterprise security models break when AI agents become the actors The core argument animating today's announcement is that decades of enterprise security architecture rests on an assumption that no longer holds -- that the actor behind every access request is a person. "Traditional security was built for a world where humans were the actors. AI agents change that completely. For decades, security models assumed people would access one application at a time, operating at human speed and within relatively defined boundaries," Upadhyay said. The deeper issue, he argued, is not novelty but exposure: "The challenge isn't that AI creates entirely new security problems. It's that AI exposes the blind spots we've always had." Organizations have never had perfect visibility into every API, dataset, and workflow, Upadhyay noted, and at human speed those gaps were manageable. Agents operating at machine speed can "combine access across systems and act on permissions that were never intended to be exercised together, amplifying those longstanding risks." His conclusion: "In the agentic era, trust can't be a one-time decision made at login. It has to be continuously verified through every agent, every action, and every interaction across the enterprise." Nancy Wang, chief technology officer of 1Password, described the failure mode in more visceral terms. When agents first arrived, she told VentureBeat, the default pattern was dangerously simple: "Let me just give the agent my credentials and it can just act as me... let's imagine you're the head of security or the head of IT, and you have access, especially admin access, to all of the systems. Well, now suddenly your agent now has admin access to all of the systems, and so it could exfil data... if it's subject to a prompt injection, for example." The audit trail becomes equally useless, she added: "Imagine the audit logs show that Michael sent a couple million dollars to an offshore account... It raises eyebrows when, in fact, it could just be an agent going off the rails and doing things that you never authorized." Her prescription, and the premise of 1Password's integration with Snowflake, is blunt: "Agents need their own identity." Inside Cortex AI Gateway: how Snowflake plans to govern agent access and rein in runaway AI costs Cortex AI Gateway, which will enter public preview soon, functions as a connective layer for what Snowflake calls "all trusted agent activity." It governs both first-party agents built inside Snowflake, such as Snowflake CoWork and CoCo, and third-party agents built on external platforms. With support for more than 100 MCP servers -- the Model Context Protocol connectors that have become the de facto standard for wiring agents to enterprise tools -- the gateway centralizes access policies, authentication, permissions, and audit logging in a single place. The gateway also addresses a less glamorous but increasingly urgent problem: runaway AI spending. It gives IT and finance teams a unified view of AI consumption, attributes costs to the specific teams, agents, or workloads driving them, and enforces spending limits before bills spiral. Upadhyay described how those costs compound in practice. "AI is dynamic. Agents can invoke multiple models, call different tools, and execute multi-step workflows, creating consumption patterns that can change from one task to the next. For example, an enterprise may deploy an AI assistant to help employees answer internal questions. A simple request that only requires retrieving a document could unintentionally be routed through a more expensive reasoning model, trigger additional searches across multiple systems, or invoke unnecessary workflows." At scale, with thousands of employees and hundreds of agents, small inefficiencies become significant line items. The gateway builds directly on Snowflake's May 2026 acquisition of Natoma, a 27-person startup whose centralized MCP gateway enforced identity, policy, and audit at the tool-call level. Forbes reported at the time that the deal -- announced the same day as Snowflake's $1.33 billion quarterly product revenue report and a $6 billion AWS compute commitment -- was the smallest of the day's three announcements by dollar value but the most revealing about where Snowflake believes the next platform fight sits: not in the data warehouse, but in the layer that decides what an agent may touch and records what it did. Dual attribution and task-scoped access: the technical blueprint for trusting autonomous agents The technical centerpiece of the partner integrations is what Snowflake calls dual attribution. "By logging both the verified non-human identity of the agent and the specific human who authorized the task, we ensure task-scoped access and complete auditability for every action taken across the enterprise," Upadhyay said. That answers a question that has stumped security teams: when an agent takes an action, whose action is it? The Snowflake model says the answer is both -- the agent's, and the human's who delegated the task -- and both must be recorded. Task-scoped access is the companion principle. Rather than inheriting a user's full standing permissions, an agent gets access only to what a specific task requires. Upadhyay acknowledged the obvious objection -- agents are dynamic and their next step often isn't known in advance. "The goal isn't to predict every action an agent will take. It's to ensure that every action an agent takes is evaluated in real time against the appropriate policies, scope, contextual signals, and the original intent of the user," he said. Wang explained how 1Password's piece works at the protocol level, pointing to emerging standards like OIDC-A: "the human, for example, first authorizes the agent to do a specific task, and then what that means is the agent will then receive sort of the delegated task specific token... as part of that token, that is where you learn of the original sort of delegator identity and also the intent behind the task." The intent-preservation problem is subtle, she noted, because enterprise tasks decompose into enormous chains of individual operations. "When they're accessing a table, you know that it's acting on behalf of the original intent that you gave that agent... a task might be a compilation of hundreds, maybe even thousands, individual actions." Keeping that intent intact across every step in the chain -- and flagging the moment an agent deviates from it -- is what the coalition is ultimately trying to standardize. SailPoint's field report: the three ways enterprise identity systems fail against AI agents Chandra Gnanasambandam, SailPoint's EVP of product and chief technology officer, brought the perspective of a vendor that has watched enterprises break their identity stacks against this problem for more than a year. SailPoint has been in the machine and agent security market for roughly 18 months, he said, with more than 100 customers on its agent identity product -- enough of a sample to catalog the recurring failures. The first is scale-driven shallowness. An average Fortune 500 company has roughly 16,000 employees, and SailPoint is seeing human-to-non-human identity ratios of at least 10 to 1 -- before counting the tools and APIs each agent touches, which multiply the count again. "You will get into a million plus non-human identities. Mapping the permissions that each of them get to the 16,000 humans is a completely non-trivial task," he said. Most companies punt, mapping agents to humans at the directory-group level. "That is grossly insufficient. You want to have fine grain context. Like I said, it's not access to Snowflake. It's access to what column and what data inside Snowflake you need." The second failure mode is drift. Modern models are relentless goal-seekers, and that persistence cuts both ways. "When you tell them get this done, the underlying models are so powerful now. Even the weaker models are so powerful. They will go find a way to get it done... They will go find the vulnerabilities to bypass the permission to get it done," Gnanasambandam warned. The answer, he argued, is runtime monitoring of the entire interaction chain, compared continuously against policy, with automatic intervention when an agent escalates beyond what its human delegator authorized. The third is missing data context. Many vendors, he argued, announce splashy integrations with big application platforms while ignoring where the actual risk concentrates. "That's not where the risk lies. Risk lies in sensitive data, so the details matter here... Can you map specific columns and rows in Databricks, Snowflake, Redshift, Oracle... into the agent context and the human context? And if you can't do that, you are going to have gaps and holes." SailPoint's answer required tearing out two decades of architecture. "We rewrote our underlying data and object model to treat AI identity as a first-class object, because for 20 years, SailPoint had a data model and object model that supported the human identity, and AI identities are fundamentally different," Gnanasambandam said, describing 12 to 18 months of deep engineering work. The result is what he calls a unified lineage: "From human to master agent to sub agent to tool to application to data. That's what I call the steel chain. That is in one data model, one platform." Why rival identity vendors joined Snowflake's coalition -- and what each side gets out of it Perhaps the most striking aspect of today's announcement is the roster. 1Password, SailPoint, Saviynt, Okta, and Aembit compete for overlapping identity and access budgets. Snowflake convinced them to build against a common trust framework anyway. "The reason we brought together leaders across the security ecosystem is because no single company can solve the agent security challenge alone. AI agents can't deliver real value if they only operate within the boundaries of one platform," Upadhyay said. His broader thesis frames the whole strategy: "Nobody wants to replace data silos with AI silos." Wang offered a pragmatic division of labor: "We bring the trust, and Snowflake brings a system of record." She framed the collaboration as classic defense in depth -- "there are data level controls, and there are identity level controls, and so together we can create a much stronger ecosystem play." There is self-interest in the openness, of course. Snowflake sits atop an enormous concentration of sensitive enterprise data -- more than 13,900 customers, by the company's count -- and every third-party agent that touches that data through a governed Snowflake gateway deepens the platform's gravitational pull. As Constellation Research analyst Michael Ni put it when the Natoma deal was announced, in comments reported by CIO.com: data platforms won the analytics era, and whoever governs agents, context, and autonomous actions wins the agentic one. A Forbes analysis of the same acquisition flagged the tension directly, noting that a governance layer living inside Snowflake risks pulling MCP's openness back toward a single vendor's control plane -- attractive for Snowflake-standardized shops, more awkward for genuinely multi-vendor agent stacks. Analyst forecasts show agent governance is now a trillion-dollar race against the clock The urgency behind today's announcement is not manufactured. Gartner predicts that by 2027, governance gaps discovered only after production incidents will force 40% of enterprises to demote or decommission autonomous AI agents -- with analysts there warning that the greatest risk an agent poses often lies not in its output but in the actions it is empowered to take. IDC, meanwhile, expects more than 1 billion actively deployed AI agents by 2029, executing roughly 217 billion actions per day, and forecasts agentic AI will exceed $1.3 trillion in worldwide IT spending that year. The research firm's analysts now argue agentic platforms should be treated as decision infrastructure, not productivity software. Against that backdrop, the identity layer is becoming the contested ground, and every major vendor -- Salesforce, ServiceNow, Microsoft, Google, Okta -- is racing toward the same runtime-governance chokepoint. Snowflake's differentiator is proximity to the data itself. As Upadhyay put it, security "can't just be an API proxy sitting in front of an LLM. It has to anchor all the way down into the underlying data layer, enforcing zero-copy boundaries, dynamic data masking, and real-time exfiltration safeguards before an agent ever touches a row of data." The rollout now moves to proving ground. Cortex AI Gateway enters public preview soon, and the five partner integrations enter private preview, a phase Wang described as a deliberate feedback loop -- customers on day one get an agent-access broker plus "a full audit log that will show you, for example, what that agent is actually doing," even when an agent deviates from its intent. Gnanasambandam, characteristically, wants enterprises to skip the easy demos entirely, urging customers to bring loan-origination workflows spanning three clouds and ten applications, half of them mainframes: "Give us that complex use case and bring anyone on and do it in your context, and we will take the challenge with anyone in the world." That confidence -- from a coalition of rivals, no less -- captures what makes this moment unusual. The companies that spent the last decade fighting over who verifies human identity have concluded, more or less simultaneously, that the next decade belongs to whoever can verify the machines acting on our behalf. Upadhyay distilled the wager into a single line: "The future of AI won't be won by the organizations with the most agents, but by the organizations that can govern those agents with the most trust, visibility, and control." In the agentic enterprise, it turns out, trust isn't the guardrail. It's the product.

Snowflake debuts Cortex AI Gateway to govern and monitor enterprise AI agents

Snowflake Inc. today introduced Cortex AI Gateway, a centralized control layer that lets enterprises connect, govern and monitor artificial intelligence agents as they reach into models, tools, Model Context Protocol servers and internal systems. The company cast the gateway as the connective tissue for the "agentic enterprise," the point at which autonomous software agents start acting across corporate data and applications rather than simply retrieving information. Traditional security architectures were not built for that level of cross-system activity, Snowflake argues, leaving organizations without a consistent way to see what their agents are doing or what those agents cost. Cortex AI Gateway is designed to govern agents built inside Snowflake, including its own CoWork and CoCo agents, alongside third-party agents developed on outside platforms such as Claude Code and Cursor. It supports more than 100 MCP servers and centralizes the access policies, authentication and permissions that decide which models, data, applications and tools each agent can touch. The product builds directly on Snowflake's acquisition of Natoma Labs Inc., the MCP governance startup it agreed to buy in May. Natoma's technology gives the gateway an enterprise-grade MCP platform for brokering secure connections between agents and the systems they act on. Access control is only part of it. The gateway keeps an end-to-end record of agent activity, giving teams a single log of which agent did what, which tools and systems it reached and the order of steps it followed. It also tracks token consumption across models, teams and workloads, attributes those costs to the agents driving them and lets finance and information technology teams enforce spending limits, a hedge against the runaway bills that can come with agents running at scale. "Enterprise AI is moving from data interoperability to agent interoperability, and security has to be at the center of that shift," said Mayank Upadhyay, chief security and trust officer at Snowflake. "Agent interoperability only works when enterprises can trust how agents from different platforms access data, invoke tools and take action on behalf of users. The future of the agentic enterprise will not be built in closed agent ecosystems, and Snowflake is the trusted control plane that enables secure enterprise work." Snowflake paired the gateway with a first wave of secure third-party agent access integrations with identity and security vendors Aembit Inc., Linx Security Inc., SailPoint Inc., Saviynt Inc. and AgileBits Inc., the maker of 1Password. The integrations target a common blind spot in which an agent operates under a user's broad credentials, making it hard to tell which agent reached which data and under whose authority. Each partner tackles a different piece. Nancy Wang, chief technology officer at 1Password, said the integration gives third-party agents short-lived, task-scoped access tied to a clear record of the person behind each agent, letting companies move agents into production without leaving them standing access to sensitive data. Aembit takes the credential angle: C0-founder and Chief ExecutiveDavid Goldschlag said its policy-based access does away with long-lived credentials. Saviynt works at runtime, weighing an agent's intent and permissions before letting it act, while SailPoint frames its role around giving security teams visibility and accountability over third-party agent access. Media intelligence firm Meltwater N.V. is one early adopter. Chief Technology Officer Aditya Jami said the gateway should let its agents connect to the right data and tools without loosening the controls its own customers count on. The gateway arrives with a batch of security updates that push zero-trust principles further into AI. Generally available now are tools for gauging AI risk posture, giving agents a verified identity and shielding sensitive data. Controls that hold an agent session to the scope of a single task remain in private preview. Cortex AI Gateway is due in public preview soon. The third-party agent access integrations will follow in private preview.

Snowflake Unveils Cortex AI Gateway to Power the Trusted Agentic Enterprise

Traditional security architectures were not designed for this level of cross-system agent activity, and organizations often lack a centralized way to govern AI usage. Snowflake introduced Cortex AI Gateway and several AI security innovations that establish the foundation for trusted agent interoperability, enabling organizations to securely scale their agentic enterprises. Cortex AI Gateway addresses two of the biggest barriers to enterprise AI adoption today by helping organizations secure AI agents, while providing centralized visibility and control over AI consumption costs. As AI agents increasingly collaborate across enterprise data, apps, and platforms, they introduce unprecedented security and governance risks, while driving growing AI consumption across models and workloads. Traditional security architectures were not designed for this level of cross-system agent activity, and organizations often lack a centralized way to govern AI usage. This requires a new security and cost model where trust enables interoperability across every AI interaction. Today, Snowflake is solidifying the foundation for a secure agent ecosystem where agents can interoperate across the enterprise with the trust, visibility, control, and cost oversight businesses need. Snowflake is unveiling Cortex AI Gateway, a major advancement that enables enterprises to securely control, orchestrate, and govern both first-party AI agents built within Snowflake, such as Snowflake CoWork and Snowflake CoCo, and third-party AI agents developed on external platforms such as Claude Code and Cursor. Cortex AI Gateway gives enterprises a unified foundation to govern how agents access models, tools, MCP servers, and enterprise systems; intelligently route agent requests; and optimize AI consumption across models and workloads. As a result, teams gain greater visibility and control across AI access, agent activity, and token usage to help prevent runaway AI costs. Cortex AI Gateway builds on Snowflake's acquisition of Natoma (May 2026), bringing Natoma's enterprise MCP platform capabilities directly into the Snowflake platform for secure, enterprise-grade agent interoperability. Snowflake also announced new secure third-party agent access integrations4 with Aembit, 1Password, Linx Security, Okta, SailPoint, and Saviynt, setting a new standard for how enterprises govern and audit AI agents across the security ecosystem. "Enterprise AI is moving from data interoperability to agent interoperability, and security has to be at the center of that shift," said Mayank Upadhyay, Chief Security and Trust Officer, Snowflake. "Agent interoperability only works when enterprises can trust how agents from different platforms access data, invoke tools, and take action on behalf of users. Snowflake provides the visibility, governance, and control capabilities needed to make that interoperability secure for production AI. The future of the agentic enterprise will not be built in closed agent ecosystems, and Snowflake is the trusted control plane that enables secure enterprise work." Cortex AI Gateway advances Snowflake's role as a secure AI interoperability layer for the agentic enterprise by establishing the gateway that helps enterprises centrally govern how AI agents access and use models, data, applications, and tools. For organizations like Meltwater, Cortex AI Gateway offers a path to make agents more useful, observable, and production-ready. "At Meltwater, we help organizations make sense of fast-moving external data and turn insights into action. As AI becomes more embedded in that work, security and trust are critical to delivering value," said Chief Technology Officer, Aditya Jami, Meltwater. "We see Cortex AI Gateway as a step towards ensuring our agents can securely connect to the right data and tools, helping us deliver trusted AI-powered insights faster while maintaining the security and control our customers expect." Cortex AI Gateway enables enterprises to: Snowflake is laying the foundation for secure third-party agent access across the security ecosystem, with the first wave of integrations from leading security vendors including 1Password, Aembit, Linx Security, Okta, SailPoint, and Saviynt. To enable enterprises to deploy third-party agents with consistent security and control, these integrations are designed to: "At Thomson Reuters, building trusted AI for professionals requires strong security, governance, and visibility into how AI systems access data, use tools, and take action," said Caitlin Halferty, Head of Data & Analytics, Thomson Reuters. "As AI becomes more deeply embedded in professional workflows, organizations need the ability to protect sensitive information and maintain clear controls without limiting innovation. Snowflake's continued investment in AI security and governance supports the kind of trusted foundation enterprises need as they move agentic AI into production." "AI agents are becoming active participants in enterprise systems, but securing them requires a fundamentally different approach than managing human access," said David Goldschlag, CEO and Co-Founder, Aembit. "Through our work with Snowflake, we're helping enterprises give third-party agents trusted, policy-based access to the resources they need, without relying on long-lived credentials, so they can reduce risk while enabling agents to operate securely at machine speed." "AI agents are introducing an entirely new class of identities into the enterprise that operate continuously, move across systems, and act on behalf of users," said Niv Goldenberg, CPO and Co-Founder, Linx Security. "Together with Snowflake, Linx is helping organizations build a more complete picture of those agent identities and the access patterns around them, so security teams can identify risk earlier and govern agent activity without slowing innovation." "One of the biggest gaps in building a secure agentic enterprise is not knowing what your agents can connect to or what they're allowed to do with that access," said Ely Kahn, Chief Product Officer, Okta. "Through our work with Snowflake and our broader effort to advance Cross App Access as an open protocol for secure AI agent connections, our joint customers can bring third-party AI agents within the identity perimeter. Together, we're helping ensure agents can operate within centralized identity policy, where every action is logged, and access is tightly scoped, before unlocking valuable enterprise data in Snowflake." "Agentic AI creates a major opportunity for productivity, but enterprises need trust, visibility, governance, and protection before they can capture that value at scale," said Chandra Gnanasambandam, EVP of Product and Chief Technology Officer, SailPoint. "Through our integration with Snowflake, SailPoint helps organizations govern third-party agent access, giving them the visibility, accountability, and control needed to move agents into production with confidence." "Traditional identity security models were built for human users, not AI agents, creating a critical gap in enterprise security," said Akhil Kapoor, Senior Vice President, Business Development, Saviynt. "Our integration with Snowflake addresses this challenge through Saviynt's Access Gateway, which evaluates agent intent, context, permissions, and risk at runtime to ensure AI agents are only authorized to perform the actions required for a specific task. It prevents privilege misuse and anomalous activity before it can impact the business."

Snowflake Advances the Trusted Agentic Enterprise Era with Unified Monitoring and Cost Management

Snowflake today introduced Cortex AI Gateway and several AI security innovations that establish the foundation for trusted agent interoperability, enabling organizations to securely scale their agentic enterprises. Cortex AI Gateway addresses two of the biggest barriers to enterprise AI adoption today by helping organizations secure AI agents, while providing centralized visibility and control over AI consumption costs. As AI agents increasingly collaborate across enterprise data, apps, and platforms, they introduce unprecedented security and governance risks, while driving growing AI consumption across models and workloads. Traditional security architectures were not designed for this level of cross-system agent activity, and organizations often lack a centralized way to govern AI usage. This requires a new security and cost model where trust enables interoperability across every AI interaction. Today, Snowflake is solidifying the foundation for a secure agent ecosystem where agents can interoperate across the enterprise with the trust, visibility, control, and cost oversight businesses need. Snowflake is unveiling Cortex AI Gateway, a major advancement that enables enterprises to securely control, orchestrate, and govern both first-party AI agents built within Snowflake, such as Snowflake CoWork and Snowflake CoCo, and third-party AI agents developed on external platforms such as Claude Code and Cursor. Cortex AI Gateway gives enterprises a unified foundation to govern how agents access models, tools, MCP servers, and enterprise systems; intelligently route agent requests; and optimize AI consumption across models and workloads. As a result, teams gain greater visibility and control across AI access, agent activity, and token usage to help prevent runaway AI costs. Cortex AI Gateway builds on Snowflake's acquisition of Natoma (May 2026), bringing Natoma's enterprise MCP platform capabilities directly into the Snowflake platform for secure, enterprise-grade agent interoperability. Snowflake also announced new secure third-party agent access integrations4 with Aembit, 1Password, Linx Security, Okta, SailPoint, and Saviynt, setting a new standard for how enterprises govern and audit AI agents across the security ecosystem. "Enterprise AI is moving from data interoperability to agent interoperability, and security has to be at the center of that shift," said Mayank Upadhyay, Chief Security and Trust Officer, Snowflake. "Agent interoperability only works when enterprises can trust how agents from different platforms access data, invoke tools, and take action on behalf of users. Snowflake provides the visibility, governance, and control capabilities needed to make that interoperability secure for production AI. The future of the agentic enterprise will not be built in closed agent ecosystems, and Snowflake is the trusted control plane that enables secure enterprise work." Powering the Centralized AI Gateway for the Agentic Enterprise For AI agents to deliver real business value, they need secure access to the models, data, applications, and tools that provide the full context of the enterprise. Today, those resources are fragmented across systems and providers, forcing teams to build and maintain custom connections while managing access, activity, and costs through disconnected controls. Cortex AI Gateway advances Snowflake's role as a secure AI interoperability layer for the agentic enterprise by establishing the gateway that helps enterprises centrally govern how AI agents access and use models, data, applications, and tools. For organizations like Meltwater, Cortex AI Gateway offers a path to make agents more useful, observable, and production-ready. "At Meltwater, we help organizations make sense of fast-moving external data and turn insights into action. As AI becomes more embedded in that work, security and trust are critical to delivering value," said Chief Technology Officer, Aditya Jami, Meltwater. "We see Cortex AI Gateway as a step towards ensuring our agents can securely connect to the right data and tools, helping us deliver trusted AI-powered insights faster while maintaining the security and control our customers expect." Cortex AI Gateway enables enterprises to: * Govern Every Agent Connection: Enterprises need a consistent way to control which models, data, applications, MCP servers, and tools each agent can access. With support for more than 100 MCP servers, Cortex AI Gateway centralizes agent access policies, authentication, permissions, and controls. * See and Understand Every Agent Action: As agents take action across enterprise systems, organizations need visibility into what each agent did, which systems and tools it accessed, and the sequence of steps it took. Cortex AI Gateway provides a centralized, end-to-end record of agent activity, giving teams the visibility needed to operate agents safely at scale. * Keep AI Consumption Costs Under Control: Fragmented AI usage across models, teams, and workloads makes AI consumption costs difficult to track and control. Cortex AI Gateway gives IT and finance teams a unified view of AI consumption, attributes costs to the teams, agents, or workloads driving them, and enforces spending limits to help prevent runaway costs before they occur. * Optimize Model Selection and Performance: Enterprises need the flexibility to use multiple models while ensuring each request is routed to the right model for the task. Cortex AI Gateway intelligently routes requests to enterprise-approved models, optimizing quality, cost, latency, and availability while maintaining centralized governance. Advancing Secure Third-Party Agent Access with Ecosystem Partners For AI agents to deliver meaningful business value, they need to work securely across platforms. Yet many vendors still default to closed ecosystems, making it difficult for third-party agents to operate across organizational boundaries. Security is the key to unlocking that interoperability by establishing the trust, identity, and access controls agents need to work safely across platforms. Snowflake is laying the foundation for secure third-party agent access across the security ecosystem, with the first wave of integrations from leading security vendors including 1Password, Aembit, Linx Security, Okta, SailPoint, and Saviynt. To enable enterprises to deploy third-party agents with consistent security and control, these integrations are designed to: * Make Third-Party Agents Governable: Enterprises can now move beyond the blind spot of agents acting under broad user credentials. With the new integrations, security teams have a clearer view into which agent accessed what data, through which platform, and under whose authority. * Enable Task-Scoped Agent Access: Third-party agents should not inherit every permission a user has just because they are acting on the user's behalf. Snowflake's approach limits agent access to only what the task requires, creating a safer model for using agents across an enterprise's data ecosystem. * Extend Consistent Governance Across Agent Ecosystems: These integrations represent an important milestone for the security industry by helping unlock a pathway toward secure cross-platform agent interoperability. Expanding AI Security for the Agentic Era Snowflake is advancing enterprise security foundations across the areas that matter most for production-ready AI. This includes new advancements that enable security teams to better understand their AI risk posture1, provide agents with a verified identity1, protect sensitive data from improper use1, apply more context-aware controls3, and limit agent sessions to the scope required for the task3. By bringing zero-trust security to the agentic enterprise, Snowflake is helping enterprises like BlackRock and Thomson Reuters strengthen security, visibility, and control as they scale AI. "At Thomson Reuters, building trusted AI for professionals requires strong security, governance, and visibility into how AI systems access data, use tools, and take action," said Caitlin Halferty, Head of Data & Analytics, Thomson Reuters. "As AI becomes more deeply embedded in professional workflows, organizations need the ability to protect sensitive information and maintain clear controls without limiting innovation. Snowflake's continued investment in AI security and governance supports the kind of trusted foundation enterprises need as they move agentic AI into production." Ecosystem Comments on the News "AI agents are moving from assisting people to acting on their behalf across critical enterprise systems. The hard problem is no longer whether an agent can do useful work; it's knowing which agent is acting, who authorized it, and what it is allowed to access," said Nancy Wang, Chief Technology Officer, 1Password. "Our work with Snowflake is designed to give third-party agents short-lived, task-scoped access with clear human-to-agent attribution, so enterprises can move agents into production without giving them standing access to sensitive data." "AI agents are becoming active participants in enterprise systems, but securing them requires a fundamentally different approach than managing human access," said David Goldschlag, CEO and Co-Founder, Aembit. "Through our work with Snowflake, we're helping enterprises give third-party agents trusted, policy-based access to the resources they need, without relying on long-lived credentials, so they can reduce risk while enabling agents to operate securely at machine speed." "AI agents are introducing an entirely new class of identities into the enterprise that operate continuously, move across systems, and act on behalf of users," said Niv Goldenberg, CPO and Co-Founder, Linx Security. "Together with Snowflake, Linx is helping organizations build a more complete picture of those agent identities and the access patterns around them, so security teams can identify risk earlier and govern agent activity without slowing innovation." "One of the biggest gaps in building a secure agentic enterprise is not knowing what your agents can connect to or what they're allowed to do with that access," said Ely Kahn, Chief Product Officer, Okta. "Through our work with Snowflake and our broader effort to advance Cross App Access as an open protocol for secure AI agent connections, our joint customers can bring third-party AI agents within the identity perimeter. Together, we're helping ensure agents can operate within centralized identity policy, where every action is logged, and access is tightly scoped, before unlocking valuable enterprise data in Snowflake." "Agentic AI creates a major opportunity for productivity, but enterprises need trust, visibility, governance, and protection before they can capture that value at scale," said Chandra Gnanasambandam, EVP of Product and Chief Technology Officer, SailPoint. "Through our integration with Snowflake, SailPoint helps organizations govern third-party agent access, giving them the visibility, accountability, and control needed to move agents into production with confidence." "Traditional identity security models were built for human users, not AI agents, creating a critical gap in enterprise security," said Akhil Kapoor, Senior Vice President, Business Development, Saviynt. "Our integration with Snowflake addresses this challenge through Saviynt's Access Gateway, which evaluates agent intent, context, permissions, and risk at runtime to ensure AI agents are only authorized to perform the actions required for a specific task. It prevents privilege misuse and anomalous activity before it can impact the business."

Snowflake Introduces Cortex AI Gateway And AI Security Innovations For Trusted Agent Interoperability

Snowflake introduced Cortex AI Gateway and several AI security innovations that establish the foundation for trusted agent interoperability, enabling organizations to securely scale their agentic enterprises. Cortex AI Gateway addresses two of the biggest barriers to enterprise AI adoption by helping organizations secure AI agents, while providing centralized visibility and control over AI consumption costs. Cortex AI Gateway acts as the connective layer for all trusted agent activity, enabling governed agent interoperability, while giving enterprises visibility and control over AI consumption costs. Snowflake is unveiling Cortex AI Gateway, a major advancement that enables enterprises to securely control, orchestrate, and govern both first-party AI agents built within Snowflake, such as Snowflake CoWork and Snowflake CoCo, and third-party AI agents developed on external platforms such as Claude Code and Cursor. Cortex AI Gateway gives enterprises a unified foundation to govern how agents access models, tools, MCP servers, and enterprise systems; intelligently route agent requests; and optimize AI consumption across models and workloads. Teams gain greater visibility and control across AI access, agent activity, and token usage to help prevent runaway AI costs. Cortex AI Gateway builds on Snowflake?s acquisition of Natoma (May 2026), bringing Natoma's enterprise MCP platform capabilities directly into the Snowflake platform for secure, enterprise-grade agent interoperability. Snowflake also announced new secure third-party agent access integrations with Aembit, 1Password, Linx Security, Okta, SailPoint, and Saviynt, setting a new standard for how enterprises govern and audit AI agents across the security ecosystem. Cortex AI Gateway enables enterprises to govern every agent connection, centralizing agent access policies, authentication, permissions, and controls. Cortex AI Gateway provides a centralized, end-to-end record of agent activity, giving teams the visibility needed to operate agents safely at scale. Cortex AI Gateway gives IT and finance teams a unified view of AI consumption, attributes costs to the teams, agents, or workloads driving them, and enforces spending limits to help prevent runaway costs before they occur. Cortex AI Gateway intelligently routes requests to enterprise-approved models, optimizing quality, cost, latency, and availability while maintaining centralized governance. Snowflake is laying the foundation for secure third-party agent access across the security ecosystem, with the first wave of integrations from leading security vendors including 1Password, Aembit, Linx Security, Okta, SailPoint, and Saviynt. These integrations are designed to make third-party agents governable, enable task-scoped agent access, and extend consistent governance across agent ecosystems. Snowflake is advancing enterprise security foundations across the areas that matter most for production-ready AI. This includes new advancements that enable security teams to better understand their AI risk posture, provide agents with a verified identity, protect sensitive data from improper use, apply more context-aware controls, and limit agent sessions to the scope required for the task. By bringing zero-trust security to the agentic enterprise, Snowflake is helping enterprises like BlackRock and Thomson Reuters strengthen security, visibility, and control as they scale AI.