{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-16T07:59:18.009Z",
  "record_id": "VXI-EXT-PROCUREMENT-SNOWFLAKE-EGRESS-01-v1",
  "record_kind": "external_reference",
  "title": "Snowflake external access: Destinations and credential grants",
  "system": "Snowflake",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does a Snowflake function with external access have unrestricted internet access?",
  "near_questions": [
    "Which destinations can a Snowflake handler contact?",
    "Which integration is attached to the function?",
    "Are allowed secrets separately selected?",
    "Who may use the integration?",
    "Does the creator need access to referenced secrets?",
    "Is external access an inbound network policy?",
    "Can a private connection change the network path?",
    "What data does the handler send?",
    "Does an integration name prove the effective allowlist?",
    "Which source version supports the access claim?",
    "When should an agent stop before an external call?",
    "Can I save an outbound-access review?"
  ],
  "supported_claims": [
    {
      "claim": "External access integrations select allowed network destinations and authentication secrets. Creating a handler that uses them also requires relevant integration and secret privileges. The integration is an outbound capability; its existence alone does not demonstrate the buyer's effective destination list or the data the handler sends.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "External access integrations select allowed network destinations and authentication secrets. Creating a handler that uses them also requires relevant integration and secret privileges. The integration is an outbound capability; its existence alone does not demonstrate the buyer's effective destination list or the data the handler sends.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Snowflake external access integrations",
    "source_url": "https://docs.snowflake.com/en/developer-guide/external-network-access/creating-using-external-network-access",
    "checked_on": "2026-10-16",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-SNOWFLAKE-EGRESS-01-v1",
    "candidate_record_sha256": "31351bc2d8c4264e9ab84de0dd41b60fb571b943158291871dbe8f895505b448",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "External access integrations select allowed network destinations and authentication secrets. Creating a handler that uses them also requires relevant integration and secret privileges. The integration is an outbound capability; its existence alone does not demonstrate the buyer's effective destination list or the data the handler sends.",
    "required_buyer_context": "Enabled integration, network rules, secret grants and handler data flow. Effective buyer configuration and dated operational evidence are required.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-16",
    "claim_to_check": "External access grants unrestricted outbound access.",
    "documented_statement": {
      "status": "documented",
      "statement": "External access integrations select allowed network destinations and authentication secrets. Creating a handler that uses them also requires relevant integration and secret privileges. The integration is an outbound capability; its existence alone does not demonstrate the buyer's effective destination list or the data the handler sends.",
      "source_ids": [
        "snowflake-egress"
      ]
    },
    "buyer_evidence_required": [
      "Enabled integration and network-rule inventory.",
      "Secret references and role grants.",
      "Handler purpose and permitted data recipients."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Require the destination and data-disclosure scope before approving external calls."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "snowflake-egress",
        "url": "https://docs.snowflake.com/en/developer-guide/external-network-access/creating-using-external-network-access",
        "final_url": "https://docs.snowflake.com/en/developer-guide/external-network-access/creating-using-external-network-access",
        "title": "Snowflake external access integrations",
        "checked_on": "2026-10-16",
        "sha256": "333d181f0a05cc33ab64fa2a06e8572dd8fd1533bd784b99b70f3d3a286d2381",
        "bytes": 182187
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Preserve the destination, credential and disclosure questions used for a data-platform decision.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Enabled integration, network rules, secret grants and handler data flow"
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#snowflake-external-access-destination-grants",
  "machine_readable_record": "/varexis-index/records/snowflake-external-access-destination-grants.json"
}