Quirin Schlegel

Loading

Your name is on the cron job - Snowflake's unattended agent runs, your default role, and a two-month record

Snowflake put CoCo automations into public preview on 21 August 2026: recurring, unattended coding-agent runs on a fixed schedule inside a managed sandbox. The governance detail is not the scheduler but the identity. A run does not use the role that was active when it was created - it starts on the user's default role with the default secondary roles activated, the agent task is owned by the user rather than a role, the EXECUTE AGENT TASK privilege sits on PUBLIC by default, and interactive tool approval is disabled for the duration of a run. Least-privilege discipline that lives in switching to a narrow role per session does not survive the transition to a schedule. The European consequence is a retention asymmetry: automation threads and run history are kept two months, while ACCOUNT_USAGE.ACCESS_HISTORY is kept one year, so the record of which SQL touched which column outlives the record of why an agent decided to run it by ten months. GDPR Article 5(2) requires the controller to be able to demonstrate compliance and Article 32(4) requires that anyone acting under the controller's authority process personal data only on instruction; after day sixty the instruction is gone and the surviving log names a human. The AI Act's own answer lands later - Article 26(6) sets an at-least-six-months floor on deployer logs for high-risk systems, and Regulation (EU) 2026/1744 moved Annex III to 2 December 2027. The automation is fine; the retention is the bug.

25 August 202610 verified claims6 sources

Snowflake shipped scheduled, unattended coding-agent runs on 21 August. The interesting line is not the scheduler. It is whose privileges the run inherits.

CoCo automations turn a prompt into a recurring job: it executes in a Snowflake-managed sandbox, at most once an hour, and writes a thread of every message and tool call it made.

Three things in the documentation that matter more than the feature itself:

1. It does not run as the role you had active when you created it. Each run starts on your user's default role, with your default secondary roles activated, and the agent task is owned by the user rather than by a role. If your least-privilege discipline lives in "switch to the narrow role for this session", the automation routes around it.

2. EXECUTE AGENT TASK is granted to PUBLIC by default. Every user in the account can create one until an administrator changes that grant. Revoking it on the account from role PUBLIC is a one-line change, and it is Monday's change.

3. Interactive tool permission prompts are disabled during a run. The docs say it plainly: do not schedule destructive or irreversible actions unless the prompt, the role privileges, the connected tools and the target objects are intentionally configured for that.

Now the European part. Automation threads and run history are retained for two months. ACCOUNT_USAGE.ACCESS_HISTORY is retained for one year. The record of which SQL touched which column outlives the record of why an agent decided to run it, by ten months.

GDPR Article 5(2) requires you to be able to demonstrate compliance. Article 32(4) requires that anyone acting under your authority processes personal data only on your instructions. After day sixty the instruction is gone and the surviving log names a human.

The AI Act's answer arrives later: Article 26(6) sets a six-month floor on deployer logs for high-risk systems, and the Digital Omnibus moved Annex III to 2 December 2027. Two months sits under a floor that is not load-bearing yet.

Export the threads. The record is the deliverable.

Which of your agents remembers less than your database does?

#AIAct #DSGVO #AgenticAI #DataGovernance #Snowflake

Evidence

What this rests on

Every factual claim in the edition above, stated on its own and checked before publication. If one of these is wrong, the argument is wrong — so they are listed where you can check them.

Snowflake put CoCo automations into public preview on 21 August 2026: recurring, unattended CoCo runs that execute on a fixed time-based schedule inside a Snowflake-managed sandbox, each run writing a Cortex thread of the agent's messages, tool calls and results.
Why it mattersThe feature under discussion, dated from the vendor's own release note rather than from coverage.
snowflakedo2026coco · snowflakere2026aug
The supported minimum scheduling frequency for a CoCo automation is once per hour, and schedules are time-based only - there are no event-based triggers.
Why it mattersBounds the blast radius per day and rules out reactive triggering.
snowflakedo2026coco
A CoCo automation run does not use the role that was active in the session when it was created; each run starts a task session whose primary role is the user's default role with the user's default secondary roles activated, and the agent task is owned by the user rather than by a role.
Why it mattersThe correction. Least-privilege practice that depends on switching to a narrow role per session does not carry into the scheduled run.
snowflakedo2026coco
The EXECUTE AGENT TASK account privilege required to create a CoCo automation is granted to the PUBLIC role by default, so every user in the account holds it unless an administrator changes the grant.
Why it mattersMakes the exposure account-wide by default and gives the one-line Monday remediation.
snowflakedo2026coco
During a CoCo automation run, interactive tool permission prompts are disabled and tools available to the run can execute without waiting for approval.
Why it mattersRemoves the human checkpoint that interactive agent use relies on.
snowflakedo2026coco
Automation threads and run history in CoCo are retained for two months.
Why it mattersThe retention figure at the centre of the edition.
snowflakedo2026coco
Snowflake ACCOUNT_USAGE historical views, including ACCESS_HISTORY and QUERY_HISTORY, retain data for one year; Access History requires Enterprise Edition or higher.
Why it mattersThe comparator: the SQL access record outlives the agent's own decision record by ten months.
snowflakedo2026account
AI Act Article 26(6) requires deployers of high-risk AI systems to keep the logs automatically generated by the system, to the extent those logs are under their control, for a period appropriate to the intended purpose and of at least six months, unless other Union or national law provides otherwise.
Why it mattersSets a six-month floor that a two-month default would sit under, once Annex III applies.
euaiactexpl2026deployer
GDPR Article 32(4) requires the controller and processor to take steps to ensure that any natural person acting under their authority who has access to personal data does not process them except on instructions from the controller, unless required to do so by Union or Member State law.
Why it mattersThe duty that binds today, as opposed to the AI Act duty that binds later.
intersoftco2026security
The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved the application of the AI Act's Annex III high-risk obligations to 2 December 2027 and Annex I to 2 August 2028.
Why it mattersPlaces the AI Act log-retention floor in the future and keeps the argument honest about what actually binds now.
whiteandcas2026eu

Sources

EU AI Act Explorersecondary
euaiactexpl2026deployer
Original Archived PDFretrieved 25 August 2026
Intersoft Consultingsecondary
Security of processing — Art. 32 GDPR
Original Archived PDFretrieved 6 September 2026 · published 25 May 2026
Snowflake Documentationprimary source
snowflakedo2026account
Original Archived PDFretrieved 25 August 2026
Snowflake Documentationprimary source
snowflakedo2026coco
Original Archived PDFretrieved 25 August 2026 · published 21 August 2026
Snowflake Release Notesprimary source
snowflakere2026aug
Original Archived PDFretrieved 25 August 2026 · published 21 August 2026
White and Casesecondary
EU AI Omnibus enters into force, amending the AI Act
Original Archived PDFretrieved 17 September 2026 · published 1 July 2026

Every source for this edition, as one PDF BibTeX — all editions

Corrections

What changed after publication

None. All ten claims verified against primary or named secondary sources on 2026-08-25.