User Access#

Access to the RelationalAI (RAI) Native App is managed through Snowflake’s role-based access control system. Two database roles that encompass the most common access patterns are created when you install the RAI Native App: one for administrators and one for developers. The app also provides a set of application roles that can be used to create custom database roles for more granular access control.

Table Of Contents#

• The rai_admin Database Role
• The rai_developer Database Role
• Application Roles
  • List of Application Roles
  • Grant Application Roles
  • Revoke Application Roles
  • Delegate Access Control

The rai_admin Database Role#

When you install the RAI Native App using the installation notebook, a rai_admin database role is created with full admin access to the app. This role can be granted to any user who needs to manage the app and its resources:

-- Grant the rai_admin role to a user.
GRANT ROLE rai_admin TO USER <user_name>;

import relationalai as rai

# Get a Provider instance.
app = rai.Provider()

# Grant the rai_admin role to a user.
app.sql("GRANT ROLE rai_admin TO USER <user_name>")

If the rai_admin role is missing or needs to be recreated, you can run the following SQL or Python to create it:

-- Create the rai_admin role.
CREATE ROLE rai_admin;
-- Grant the `all_admin` application role to the rai_admin role.
GRANT APPLICATION ROLE relationalai.all_admin TO ROLE rai_admin;

import relationalai as rai

# Get a Provider instance.
app = rai.Provider()

# Create the rai_admin role.
app.sql("""
BEGIN
  -- Create the rai_admin role.
  CREATE ROLE rai_admin;
  -- Grant the `all_admin` application role to the rai_admin role.
  GRANT APPLICATION ROLE relationalai.all_admin TO ROLE rai_admin;
END;
""")

The rai_developer Database Role#

The rai_developer database role is created when you install the RAI Native App using the installation notebook. This role is intended for users who need to develop and test RAI models and applications using the RAI Python API. A user with this role can:

• Use the RAI Native App.
• Create, use, and delete RAI engines.
• Create, manage, and delete data streams.
• Enable and disable the CDC Service.

To grant the rai_developer role to a user, use the following SQL or Python:

-- Grant the rai_developer role to a user.
GRANT ROLE rai_developer TO USER <user_name>;

import relationalai as rai

# Get a Provider instance.
app = rai.Provider()

# Grant the rai_developer role to a user.
app.sql("GRANT ROLE rai_developer TO USER <user_name>")

If the rai_developer role is missing or needs to be recreated, you can run the following SQL or Python to create it:

-- Create the rai_developer role.
CREATE ROLE rai_developer;
-- Grant the `rai_user` application role to the rai_developer role.
GRANT APPLICATION ROLE relationalai.rai_user TO ROLE rai_developer;

import relationalai as rai

# Get a Provider instance.
app = rai.Provider()

# Create the rai_developer role.
app.sql("""
BEGIN
  -- Create the rai_developer role.
  CREATE ROLE rai_developer;
  -- Grant the `rai_user` application role to the rai_developer role.
  GRANT APPLICATION ROLE relationalai.rai_user TO ROLE rai_developer;
END;
""")

Application Roles#

Application roles can be used to create custom database roles for granular access control to the RAI Native App.

List of Application Roles#

The following application roles are available in the RAI Native App.

Service Roles#

Service roles provide access to the RAI Native App, its logs, and billing information.

Resource Roles#

Resource roles provide access to all of the RAI Native App’s resources.

Integrated Roles#

These roles combine multiple service and resource roles into roles for common access patterns.

Grant Application Roles#

Application roles may be granted by the RAI Native App owner to Snowflake database roles using the GRANT APPLICATION ROLE SQL command. These database roles can then be assigned to users in order to grant them access to the RAI Native App:

-- Grant a RAI application role to a Snowflake database role.
GRANT APPLICATION ROLE relationalai.<app_role_name> TO ROLE <database_role_name>;

-- Grant the database role to a user.
GRANT ROLE <database_role_name> TO USER <user_name>;

import relationalai as rai

# Get a Provider instance.
app = rai.Provider()

# Grant a RAI application role to a Snowflake database role.
app.sql("""
BEGIN
    GRANT APPLICATION ROLE relationalai.<app_role_name> TO ROLE <database_role_name>");
    GRANT ROLE <database_role_name> TO USER <user_name>");
END;
""")

Revoke Application Roles#

Application roles may be revoked from Snowflake database roles by the RAI Native App owner using the REVOKE APPLICATION ROLE SQL command.

REVOKE APPLICATION ROLE relationalai.<app_role_name> FROM ROLE <database_role_name>;

import relationalai as rai

# Get a Provider instance.
app = rai.Provider()

# Revoke the `all_admin` role from the ACCOUNTADMIN database role.
app.sql("REVOKE APPLICATION ROLE relationalai.all_admin FROM ROLE ACCOUNTADMIN")

Delegate Access Control#

App owners may delegate user access management to other users by granting them access to stored procedures that grant and revoke application roles.

For example, the following creates a stored procedure that grants a RAI application role to a Snowflake database role and grants access to the procedure to the ACCOUNTADMIN database role:

#-- Create a stored procedure for granting RAI application roles.
CREATE PROCEDURE GRANT_RAI_APP_ROLE(app_role STRING, target_role STRING)
RETURNS TABLE(STRING)
LANGUAGE SQL
EXECUTE AS OWNER
AS
BEGIN
    LET qualified_app_role STRING := 'relationalai.' || :app_role;
    LET query STRING := 'GRANT APPLICATION ROLE IDENTIFIER(?) TO ROLE IDENTIFIER(?)';
    LET rs RESULTSET := (EXECUTE IMMEDIATE :query USING (qualified_app_role, target_role));
    RETURN TABLE(rs);
END;

-- Grant access to the GRANT_RAI_APP_ROLE procedure the ACCOUNTADMIN database role.
GRANT EXECUTE ON PROCEDURE GRANT_RAI_APP_ROLE TO ROLE ACCOUNTADMIN;

Use a similar delegation pattern for revoking access to application roles.