Snowflake adds governed context and spend limits for AI agents

A single, approved meaning for business terms

Snowflake argues that even a well-governed agent can give an answer nobody agrees on if teams define a metric such as net revenue in different ways. Its answer is Business Ontology, which will enter public preview soon. It is the newest part of Snowflake Horizon Context and gives organizations one governed place to record what core business concepts mean, independent of any specific data structure.

The feature works alongside two others. Snowflake Cortex Sense, also coming to public preview soon, finds context across the data. Business Ontology makes that context authoritative, and Snowflake Semantic Views turn it into governed, consistent metrics. Cortex Sense can help bootstrap an ontology from existing context in Snowflake and can suggest definitions as the business changes, but according to Snowflake the human owner of a concept controls whether a definition becomes official.

Organizations that keep definitions in a third-party catalog or a spreadsheet can use guided glossary import, run in a single session with Snowflake CoCo, the company's coding agent. The import extracts domains, candidate terms, relationships and linked data assets, and marks each as a draft for its owner to approve through a steward approval workflow. Where a difference is intentional, such as a metric defined differently by region, each version stays as an approved definition labeled with where and when it applies. If Cortex Sense infers something that conflicts with an approved definition, agents use the approved one.

Horizon Context supplies the underlying foundation. Its connectors collect schemas, query logs, dashboard definitions and usage signals from sources such as Tableau, Power BI, dbt, SQL Server and PostgreSQL, then enrich them with lineage, tags, AI-generated descriptions and popularity signals.

One gateway for agent connections and actions

The second theme is control over agents themselves. Snowflake says teams are connecting agents to models, MCP servers and enterprise systems faster than IT and security can track them. Cortex AI Gateway, now in public preview, is meant as a centralized, governed entry point for agents to reach models and data. It applies a consistent set of policies across supported clouds, frameworks and AI providers, and because it governs from where the data lives, agents inherit the organization's existing identity and access controls. According to Snowflake, teams do not need to create a second set of credentials for agents.

• Cortex Sandboxes (private preview) give agents a private space to run custom code next to enterprise data, following the permissions of the person running the agent. Snowflake says they launch in seconds and shut down automatically when finished.
• MCP governance through Cortex AI Gateway Tools (public preview) authenticates agent tool calls with the end user's identity and checks them against policy before they run. The system can block unapproved API calls, unauthorized actions and compliance violations.
• Cortex AI Guardrails (public preview) adds account-wide runtime protection against prompt injection, jailbreaks and novel attacks for every agent routed through the gateway, including third-party agents.

Seeing and capping what agents do and spend

Snowflake's Observability feature, which is generally available, records every model call, tool invocation, reasoning step and guardrail decision in governed tables inside the customer's own Snowflake account. The traces can be queried with standard SQL and joined to other business data. Building on that, Agent Trace Intelligence (private preview) looks for agents wasting money in loops, tools that keep failing and the real cost of each completed task.

On spending, Cost Governance capabilities are generally available. They attribute AI spend to a team, department, agent or application and enforce hard limits in near real time, so managers can stop runaway agents before they exceed budgets. Dynamic Model Routing (private preview) matches each request to an organization-approved model based on cost, accuracy and latency, keeping routine work off the most expensive models. Snowflake says internal testing showed "up to 3x greater token efficiency than a frontier-model-only path at the same quality". That figure is the company's own and has not been independently verified.

Observe by Snowflake for agents and infrastructure

Snowflake also described updates to Observe by Snowflake, its AI-powered observability platform for engineering teams. Observe has rebuilt its ingestion pipeline on Snowpipe Streaming (private preview), writing logs, metrics and traces directly into Snowflake tables so engineers handling an incident see current data. Snowflake Data Share into Observe (private preview) turns data customers already hold in their own Snowflake accounts into zero-copy Observe data sets, avoiding a second round of ingestion and storage. The O11y Agent in Slack (private preview) automates first response to new issues and posts root cause analysis in a team's Slack channel. For teams building their own agents and LLM applications, Agent Observability (private preview) tracks performance, errors and token usage.

What it means for enterprise teams

Snowflake is positioning the package as a way to avoid choosing between scaling agents quickly and accepting security, compliance and cost risk. For customers already running data on the platform, the pitch is that definitions, access policies, traces and budgets sit in one system instead of in separate tools. Availability varies widely: Observability and Cost Governance are generally available, the gateway, tool governance and guardrails are in public preview, and Business Ontology and Cortex Sense are still to reach public preview. Sandboxes, Trace Intelligence and Dynamic Model Routing remain in private preview, so organizations will need to check which pieces they can use today.