Role grants for the new warehouse
Ticketclosed
Mossbrook Data Partners · Role grants for the new warehouse
Customer tightened reader grants on a test database after advice that the connector needs only read and usage. The refresh ran clean, and confirmation of the minimum grant set was requested.
What happened
What this says
As at Fri 9 Oct 2026Customer tightened reader grants on a test database after advice that the connector needs only read and usage. The refresh ran clean, and confirmation of the minimum grant set was requested.
Problem: Ciaran Doherty asked for the minimum grants the B-Viz connector needs before anything changes in production.
Handling: Connor Webb said the connector needs read on the schemas it indexes and usage on the warehouse, with no write access. Ciaran removed the unused object grants on the test database, and the refresh ran clean there, so he kept the schema-level usage grant.
Watch: Ciaran asked Connor to confirm that grant is the minimum, and the evidence does not show a reply. He said he would make no production changes until the test database was clean.
Details
Updated 9 Oct 26Trail
created · Ciaran Doherty 29 Sep 2025 08:37Hi, We're setting up the Snowflake side of the B-Viz connection for our own team and I want to make sure the roles are right before anything goes near production. At the moment the reader role seems to have more grants on the schema than the documentation suggests, and I can't tell which of them the search route actually needs. What I need to know is the minimum set of grants the connector requires on each schema, and whether any of it has to sit on the warehouse rather than the database. I'd rather tighten this now than explain it later to our client. I've checked the role grants myself on our test account and can paste the output if it helps. Happy to do a call if that's quicker. Ciaran- Public reply · Connor Webb 29 Sep 2025 11:38Hi Ciaran, Thanks for getting in early on this. The connector needs read on the schemas it indexes and usage on the warehouse it runs on. It doesn't need write on anything. Could you paste the grant output for the reader role? That will show me which extra grants are there, and then I can say which ones are safe to remove. Thanks, Connor
- Public reply · Connor Webb 30 Sep 2025 12:41Hi Ciaran, Following up on the grants list. There are a few object-level grants that the connector doesn't use. I'd suggest we remove those on the test database first and run a full refresh before touching production. Would that work for you? Connor
- Public reply · Ciaran Doherty 30 Sep 2025 16:26Agreed, let's do it on the test database first. I'll remove the unused object grants tonight and run the refresh tomorrow morning, then I'll tell you what breaks. I'm not making any changes on the production account until that's clean. Ciaran
- Public reply · Ciaran Doherty 2 Oct 2025 10:31Update: the refresh ran clean on the test database after the change. Search and the chat route both return what they should. The only thing I'd flag is that the schema-level usage grant is still needed, so I've left that in. Can you confirm that's the minimum? Ciaran
- Status change · 11 Oct 2025 23:59