Snowflake adds shared business definitions and central controls for AI agents

AI agents working with company data would draw on approved business definitions and share access and spending rules under capabilities Snowflake announced on November 3 at Snowflake Expedition 2026. Business Ontology and Cortex AI Gateway put those functions inside Horizon Catalog, pairing context for an agent’s answers with controls over its actions.

Who decides what net revenue means?

Business Ontology is a governed register of business terms within Horizon Context, part of Horizon Catalog. Teams can approve a definition for a concept such as net revenue, assign an accountable owner and connect that meaning to the tables and views containing the relevant data. Snowflake says those definitions can apply to data inside and outside its platform.

The architecture separates meaning from calculation and inference. Business Ontology records the official definition; a Semantic View handles how a metric is calculated; and Cortex Sense infers context that has not been explicitly defined. Snowflake says human-approved definitions take precedence over competing inferences when its agents assemble their responses.

Existing definitions need not start from scratch. Snowflake describes a guided session with CoCo, its coding agent for data teams, that imports material from a third-party catalog or spreadsheet. It extracts candidate terms, relationships and linked data assets, then marks them as drafts for owners to approve. Changes are logged so teams can look up a definition’s earlier meaning and who approved it.

Snowflake names dentsu and its data and technology agency Merkle as users. Joe Tobey, dentsu’s head of data product engineering, described the need to keep attributes such as household income bands and business segments consistently defined as agents become a way to query that data.

A shared checkpoint for agent actions

Cortex AI Gateway handles a different problem: governing connections to models, tools and enterprise systems across clouds, agent frameworks and AI providers. Snowflake says agents inherit controls already established for human users, rather than requiring teams to maintain a separate set of permissions for agent operations.

For tool connections using Model Context Protocol, or MCP, the gateway authenticates each call and checks it against detailed authorization policies before execution. Snowflake says the checks apply whether an agent acts autonomously or on a user’s behalf, with records of tool calls and the identity under which they run.

Spending controls attribute AI costs to users, teams, departments, agents or applications and enforce hard budget limits. Snowflake names Glean and Kargo as gateway users. Kargo’s account offers a concrete example of the intended benefit: identifying which teams and agents are responsible for the bill.

We run a lot of AI against a lot of data, and the question we couldn't answer was which teams and which agents were driving the spend

Andy Owens, VP of Data and AI at Kargo, in Snowflake’s announcement

Controls beyond the initial request

The announcement also describes controls for code execution and reviewing an agent’s work. These address different stages of a task, rather than treating permission to call a model as permission for everything that follows:

• Cortex Sandboxes provides private environments for custom code alongside Snowflake data. Snowflake says they follow the permissions of the person running the agent and shut down automatically when execution finishes.
• Agent Abuse Detection examines sequences of agent actions, not just individual prompts, to identify overreach or employees using agents to bypass approvals or extract sensitive information.
• Observability stores activity records in the customer’s own Snowflake account. Agent Trace Intelligence lets teams query those records alongside business data to investigate failing tools, costly loops and spending per completed task.