Snowflake CoCo Automations: Schedule AI Agents — But Revoke the PUBLIC Grant First

Snowflake shipped CoCo Automations into public preview on August 21 — scheduled, unattended AI agent runs that execute in Snowflake-managed sandboxes. The feature is genuinely useful for data teams. Run these three SQL commands before you touch it.

By default, EXECUTE AGENT TASK is granted to the PUBLIC role — meaning every user in your account can schedule AI agents without administrator approval. Worse, behavior change bundle 2024_08 set DEFAULT_SECONDARY_ROLES to ALL for most users, so an automation runs with the union of every role you have ever accumulated, not just your active session role. Interactive safety prompts are disabled during unattended runs. There are no guardrails by default.

The Three SQL Commands You Need First

-- Verify the privilege exists
SHOW GRANTS TO ROLE PUBLIC;

-- Remove the default
REVOKE EXECUTE AGENT TASK ON ACCOUNT FROM ROLE PUBLIC;

-- Grant only to roles that need it
GRANT EXECUTE AGENT TASK ON ACCOUNT TO ROLE automation_user;

-- Also reset secondary roles for service accounts
ALTER USER service_account SET DEFAULT_SECONDARY_ROLES = ();

This is an account-level privilege that disables safety gates on AI-driven execution. Snowflake should have defaulted it to OFF. They didn’t. Fix it now, then explore the feature. The security analysis by THE D*AI*LY BRIEF covers the full scope of what’s exposed.

What CoCo Automations Actually Are

CoCo (short for Cortex Code, rebranded at Snowflake Summit June 2026) is Snowflake’s data-native AI coding agent. Unlike Claude Code or GitHub Copilot, it is grounded in your live schemas, RBAC policies, and data lineage before it generates anything. What’s new as of August 21 is automations: the ability to schedule recurring, unattended CoCo runs on a fixed schedule.

Each automation creates an AGENT TASK object stored in USER$.PUBLIC under the prefix COCO_ROUTINE_. When the schedule fires, Snowflake spins up a sandbox, mounts your workspace, and runs the agent under your default role and default secondary roles. Every run generates a Cortex thread you can inspect or continue. Automations created in the CLI are visible and manageable in Snowsight, and vice versa. Commercial AWS, Azure, and GCP only — FedRAMP, DoD, and government deployments are excluded from preview.

Getting Started With the CLI

The CLI interface is straightforward. Create an automation, run a test, and check recent runs before you trust it in production:

cortex automation create \
  --name daily_pipeline_check \
  --prompt "Check yesterday's pipeline failures and summarize in Slack. This runs unattended — complete without asking follow-up questions." \
  --schedule "daily at 9am" \
  --timezone "America/Los_Angeles"

# Test run (blocks until complete)
cortex automation execute daily_pipeline_check --wait

# Inspect recent runs and thread IDs
cortex automation doctor daily_pipeline_check

Scheduling supports intervals (every 4 hours), specific times (daily at 9am), and weekly patterns (every Tuesday at 9am and every Friday at 2pm). The minimum scheduling frequency during preview is one hour. You can attach MCP servers (--mcp), mount Snowflake stages as a workspace, and connect GitHub access via Snowflake secrets.

Write Prompts That Actually Work Unattended

Because interactive prompts are disabled, the automation prompt determines whether the run succeeds or silently fails. Follow these rules:

• Explicitly state the run is unattended and must complete autonomously without follow-up questions
• Include exact names for data objects, repositories, Slack channel IDs, and user references
• Define expected output destination — Slack channel, Snowflake table, or file
• Specify behavior when data is missing or tools fail
• End with a clear success or failure indicator so you can audit the thread transcript

Preview Limitations to Know

Minimum scheduling frequency is one hour. Thread history is retained for two months. There is no event-triggered scheduling yet — only fixed schedules. Automations cannot access local files or locally-configured MCP servers; use mounted Snowflake stages instead. One quiet audit gap: failed pre-run hooks still report as successful runs. Monitor thread transcripts, not just task status.

Billing applies during preview: standard Snowflake task charges plus CoCo token consumption per run. Check the August 21 release notes for the Snowflake Service Consumption Table reference.

Where This Fits in the 2026 Agentic Scheduling Wave

CoCo Automations is part of a clear August 2026 pattern. GitHub Copilot shipped async agent work in Slack on August 21. Databricks Lakebase extended its agent sandbox capabilities on August 11. Every major data platform is shipping always-on agent capabilities, and most of them are shipping with loose defaults. The lesson generalizes: when a platform grants execution rights to PUBLIC by default and disables safety prompts, the first task is tightening configuration — not exploring the feature.

Databricks Genie Code, the closest competitor, is still notebook-bound and cannot be scripted or scheduled. On that specific capability, CoCo has a real lead today. The feature is worth enabling — once you’ve locked it down.