How to scope a read-only role for a referred client's schema
Ticketsolved
Mossbrook Data Partners · How to scope a read-only role for a referred client's schema
A referred client's read-only role needed warehouse usage and an owner-side grant on a secure view. The customer resolved both and the view now lists.
What happened
What this says
As at Fri 9 Oct 2026A referred client's read-only role needed warehouse usage and an owner-side grant on a secure view. The customer resolved both and the view now lists.
Problem: The connector errored when listing views in a referred client's analytics schema under a read-only role. Handling: Olivia Grant confirmed that usage on the warehouse was needed and that the secure view's owning role needed a grant, which the customer made. She pointed to the knowledge base article on scoping a read-only role. Watch: The customer plans to write a note on the scoping for the client, so the set-up documents may need to match the final grant.
Details
Updated 9 Oct 26Trail
created · Ciaran Doherty 22 Sep 2026 12:42Hi team, Quick one. We're setting up a referred client on their own Snowflake account and want the B-Viz role to read their analytics schema without any write access. I've read the setup guide twice and I can see the read grant on the schema, but the connector still errors when it tries to list the views under it. Before I go digging through my own grants again: is the role meant to have usage on the warehouse as well, or is that handled on your side? I'd rather not widen anything blind. Happy to send the query history if it helps. Ciaran- Public reply · Olivia Grant 23 Sep 2026 04:42Hi Ciaran, thanks for the detail. You're right that the role needs usage on the warehouse as well as read on the schema. Without it the listing step fails with a permissions error rather than a clear message. The write grant can stay off. Could you run a show grants on the role and paste the output here? That will tell me quickly which piece is missing. Thanks, Olivia
- Public reply · Ciaran Doherty 25 Sep 2026 13:47I checked the role grants. Usage was missing on the warehouse, read is there on the schema. Added usage and listing works now. Still getting an error on one view. It's a secure view owned by a different role. Which warehouse is that running on? Not sure whether that's ours to fix or yours. Ciaran
- Public reply · Olivia Grant 28 Sep 2026 13:56Thanks, that narrows it down. The ownership of the secure view is on your side. The owning role needs the read path on the underlying table, so your admin will need to make that change. We can't do it from our end without going into your account, and we don't do that. I've written up the exact grant statement in the knowledge base article on scoping a read-only role. If it still fails after that, reply here and I'll pick it up. Olivia
- Public reply · Ciaran Doherty 30 Sep 2026 12:13Ran the grant. The view lists now. Thanks for the pointer. I'll write a short note on the scoping for the client so they can keep it with the set-up documents. Ciaran