{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-16T02:40:06.177Z",
  "record_id": "VXI-EXT-PROCUREMENT-SNOWFLAKE-SECONDARY-01-v1",
  "record_kind": "external_reference",
  "title": "Snowflake sessions: The primary role is not the whole access picture",
  "system": "Snowflake",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does a restricted primary Snowflake role prove the session cannot use broader privileges?",
  "near_questions": [
    "Can secondary Snowflake roles authorise a query?",
    "Does CREATE use the same role evaluation as SELECT?",
    "Which roles are active in the session?",
    "Do inherited roles contribute privileges?",
    "Can a secondary role carry object ownership?",
    "Does a role name prove its current grants?",
    "Can the active role set change mid-session?",
    "Which identity should a query review record?",
    "What evidence supports a limited-access claim?",
    "Are database roles directly activated as session roles?",
    "When should an agent ask for role context?",
    "Can I save a Snowflake session-permission review?"
  ],
  "supported_claims": [
    {
      "claim": "Active secondary roles contribute privileges for many SQL operations alongside the primary role and inherited grants. Creation authority is evaluated differently, through the primary role. Inspect the active role set and operation rather than infer the complete permission boundary from the primary-role name.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "Active secondary roles contribute privileges for many SQL operations alongside the primary role and inherited grants. Creation authority is evaluated differently, through the primary role. Inspect the active role set and operation rather than infer the complete permission boundary from the primary-role name.",
  "related_record_ids": [
    "VXI-EXT-PROCUREMENT-ENTRA-CAE-01-v1",
    "VXI-EXT-PROCUREMENT-WORKSPACE-APP-SCOPES-01-v1",
    "VXI-EXT-PROCUREMENT-AWS-ROLE-CUTOFF-01-v1",
    "VXI-EXT-PROCUREMENT-GITHUB-APP-IDENTITY-01-v1",
    "VXI-EXT-PROCUREMENT-GITLAB-PAT-ROTATION-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Snowflake active roles and privilege evaluation",
    "source_url": "https://docs.snowflake.com/en/user-guide/security-access-control-overview",
    "checked_on": "2026-10-16",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-SNOWFLAKE-SECONDARY-01-v1",
    "candidate_record_sha256": "3e78a2b62e8a4517811b37d534897c3aa0a1666d0796aa04fd4d67b0f9c6f194",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Active secondary roles contribute privileges for many SQL operations alongside the primary role and inherited grants. Creation authority is evaluated differently, through the primary role. Inspect the active role set and operation rather than infer the complete permission boundary from the primary-role name.",
    "required_buyer_context": "Snowflake: Active roles, inherited grants, ownership and SQL operation; buyer configuration and operational evidence are required.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-16",
    "claim_to_check": "The primary role name establishes all effective session permissions.",
    "documented_statement": {
      "status": "documented",
      "statement": "Active secondary roles contribute privileges for many SQL operations alongside the primary role and inherited grants. Creation authority is evaluated differently, through the primary role. Inspect the active role set and operation rather than infer the complete permission boundary from the primary-role name.",
      "source_ids": [
        "snowflake-roles"
      ]
    },
    "buyer_evidence_required": [
      "Primary and active secondary role identities.",
      "Inherited grants and object ownership.",
      "The exact operation and its authorisation evidence."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Do not equate a narrow primary role with a narrow session without the secondary-role context."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "snowflake-roles",
        "url": "https://docs.snowflake.com/en/user-guide/security-access-control-overview",
        "final_url": "https://docs.snowflake.com/en/user-guide/security-access-control-overview",
        "title": "Snowflake active roles and privilege evaluation",
        "checked_on": "2026-10-16",
        "sha256": "7214e48f84640959b28d2f47b9c394723c18b61b2a2b42b0210bebb5f7201b70",
        "bytes": 177785
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Retain the actual role-combination questions needed for an access decision.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Active roles, inherited grants, ownership and SQL operation"
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#snowflake-secondary-role-authority",
  "machine_readable_record": "/varexis-index/records/snowflake-secondary-role-authority.json"
}