Enterprise security broke the moment AI agents stopped asking for permission and started executing multi-step workflows across corporate data stores. Giving an autonomous agent standard user credentials isn't just risky—it's an operational landmine.
On July 28, 2026, Snowflake announced the Cortex AI Gateway from its Bozeman, Montana base. The new control plane attempts to solve the fundamental breakdown in modern enterprise security: traditional identity models were built for human beings operating at human speed, while autonomous software agents act at machine speed across decoupled platforms.
By integrating deeply with identity providers like 1Password, SailPoint, Saviynt, Aembit, and Linx Security, Snowflake is placing a stake in the ground. The battle for enterprise AI isn't just about who hosts the data or who owns the underlying model—it's about who governs what agents are allowed to touch.
Defining the Enterprise AI Platform in the Agentic Era
Before diving into governance mechanics, we need to clarify what is an enterprise ai platform in today's software environment.
An enterprise AI platform is the underlying infrastructure that unifies corporate data management, model orchestration, identity boundaries, security controls, and agent execution into a single governed operational layer. It moves beyond raw data warehousing or isolated LLM endpoints to provide a trusted environment where both human workers and autonomous digital agents can process queries, invoke APIs, and trigger actions safely at scale.
Without centralized governance, enterprise platforms fragment instantly. As organizations deploy AI assistants across departments, they risk recreating the exact data silos they spent the last decade tearing down. Agentic data platforms must function as active security policy enforcers, ensuring that every tool call, context window retrieval, and database modification remains strictly bounded by organizational rules.
Why Agentic Data Platforms Require Identity-First Security
Traditional Enterprise Identity and Access Management (IAM) systems operate on a simple assumption: a human logs in, authenticates with a password or passkey, and assumes a set of standing permissions for the duration of a session.
AI agents completely invalidate that model. When a developer or manager delegates a project to an autonomous tool like Anthropic's Claude Code or Cursor, the temptation has been to assign the agent standard employee credentials.
Nancy Wang, Chief Technology Officer at 1Password, highlighted the failure mode of this approach. If an executive delegates a financial or analytical task to an agent using their own admin credentials, that agent inherits full administrative access across the entire software stack. If that agent succumbs to prompt injection or experiences drift, it can exfiltrate sensitive data or trigger unauthorized transfers. See When Your AI Assistant Becomes a Ransomware Accelerant for how excessive permissions amplify these risks.
Even worse, standard audit logs become useless. If an audit log shows a senior manager transferring funds or modifying confidential records, security teams can't easily discern whether the action was taken intentionally by the person or automatically by an out-of-control agent acting on their behalf. As Wang noted, agents require their own distinct identities rather than piggybacking on human session tokens. See Agents as Identities: The IAM Gap Every Enterprise Is Ignoring for a deeper look at how enterprises are struggling to close this identity divide.
Snowflake Chief Security and Trust Officer Mayank Upadhyay emphasized that the core risk isn't necessarily novel vulnerability types, but raw exposure. Human operators working across APIs and database tables hit physical limits; machine agents operating at lightning speed can chain permissions across multiple systems in ways system architects never intended, magnifying existing structural blind spots.
Inside Cortex AI Gateway: Dual Attribution and Task-Scoped Access
Snowflake's Cortex AI Gateway addresses these exposure vectors directly at the tool-call level. The product stems from Snowflake's May 2026 acquisition of Natoma, a 27-person startup specializing in Model Context Protocol (MCP) policy enforcement.
The gateway supports over 100 MCP server connectors, establishing a unified control point for both internal Snowflake agents (such as Snowflake CoWork and CoCo) and third-party external agents. It relies on two foundational technical concepts:
- Dual Attribution: Every action logged by the gateway records two distinct identities—the verified non-human identity of the executing AI agent and the human delegator who authorized the high-level intent. This creates an unalterable audit trail that links machine execution back to human accountability.
- Task-Scoped Access: Rather than granting an agent standing access rights, the gateway issues temporary, task-scoped credentials. Drawing on protocols like OIDC-A, agents receive delegated, short-lived tokens restricted to the precise parameters of the active request.
As Upadhyay explained, the goal isn't to predict every granular step a dynamic agent might take during execution. Instead, the gateway continuously evaluates every individual action in real time against policy constraints, contextual signals, and the originating user's intended scope. If an agent strays from its delegation context, the framework intercepts the request before data leaves the boundary. The Context Gap: Why Most Enterprise AI Agents Are Confidently Wrong explores how contextual failures compound when agents operate without strict boundaries.
The Identity Coalition: How 1Password and SailPoint Unify Governance
What makes Snowflake's announcement notable is the alignment of competing identity vendors around a single data platform control layer. Security leaders including 1Password, SailPoint, Saviynt, Aembit, Linx Security, and Okta are building integrations directly into the Cortex AI Gateway framework.
This collaboration tackles what identity teams call the "non-human identity explosion."
Chandra Gnanasambandam, EVP of Product and CTO at SailPoint, outlined the staggering scale of the problem. A typical enterprise with 16,000 human employees routinely generates a non-human identity ratio of at least 10 to 1—yielding over a million active service accounts, bot tokens, and agent identities. Mapping granular permissions from millions of machine identities back to human owners using legacy directory groups is impossible. Governing Non-Human Identities: Why AI Agents Broke Enterprise Security explores how the industry is responding to this identity explosion.
SailPoint spent 18 months re-engineering its core data model to treat AI identities as first-class objects within its SailPoint Agentic Fabric. Gnanasambandam calls this complete lineage the "steel chain": tracking permission flow seamlessly from the human delegator to the master agent, down through sub-agents, tool integrations, applications, and specific database columns.
Gnanasambandam pointed out three primary failure modes in legacy identity stacks:
- Scale-Driven Shallowness: Coarse directory-level mapping that grants broad platform access instead of restricting query rights to specific rows and columns.
- Agent Drift: High-capability language models relentlessly pursuing goals and bypassing implicit security assumptions to complete tasks.
- Missing Data Context: Governance tools that secure high-level software application APIs while ignoring where raw data actually resides.
By linking identity providers with Snowflake's underlying engine, governance moves from static API proxies down into the data layer itself, enabling dynamic masking and zero-copy data boundaries.
Controlling Consumption and Preventing Runaway AI Costs
Beyond identity and security risks, enterprise deployment of autonomous agents creates acute financial risks. Unmonitored agents operating in loops can generate massive compute and token consumption bills in minutes.
In complex workflows, an agent answering an internal employee query might inadvertently route a simple document lookup through an expensive multi-step reasoning model, trigger unnecessary external searches, and invoke redundant API routines. Multiplied across thousands of corporate users, small architectural inefficiencies quickly snowball into six-figure surprises.
The Cortex AI Gateway embeds unified cost monitoring directly into its access plane. IT and finance teams gain real-time visibility into token usage, attributing compute expenditure to specific teams, individual agents, and distinct workloads. Finance managers can set policy-based budget caps that restrict or throttle agent execution before costs exceed approved limits.
The Strategic Imperative for Modern Data Infrastructure
The rush toward agentic governance reflects urgent market deadlines.
Analyst firm Gartner predicts that by 2027, late-discovered governance and security gaps will force 40% of enterprise organizations to demote or decommission their autonomous AI agents. Meanwhile, IDC forecasts that worldwide IT spending on agentic AI will top $1.3 trillion by 2029, driven by more than 1 billion active agents executing 217 billion automated daily actions.
As tech giants compete over agent orchestration layers, the security boundary has shifted. Building powerful models is no longer enough; enterprises demand rigorous control over what those models can touch and execute.
Snowflake's Cortex AI Gateway demonstrates that securing agentic data platforms requires fusing data controls directly with non-human identity management. Organizations that master this trust layer will deploy autonomous agents with confidence, while those relying on legacy IAM models will find themselves forced to pull the plug on their own automation initiatives.
