A Cortex AI agent is an AI-driven workflow or application built inside Snowflake Cortex that can query data, generate content, or orchestrate tasks. Because it operates near governed data, it can inherit access, execute logic autonomously, and create security and compliance exposure if permissions and guardrails are not aligned.
Expanded Definition
A Cortex AI agent is best understood as an execution-capable AI workflow, not just a chatbot with a data connection. It can retrieve governed information, compose responses, and trigger actions inside the surrounding platform context, which means its security posture is shaped by the permissions, data boundaries, and business logic it is allowed to use.
The key boundary is that the agent’s risk profile comes from what it can access and do, not only from what model powers it. If an agent can see sensitive data, issue queries, or orchestrate downstream steps, it becomes part of the control plane for that environment. Guidance is still evolving on how much autonomy is acceptable in production systems, so practitioners should treat “agent” as an operational role with governance implications, not a product label.
For a useful external baseline on agentic risk patterns, see the OWASP Top 10 for Agentic Applications 2026.
Examples and Use Cases
Cortex AI agents typically show up where natural-language interaction is connected to governed data or workflow automation. The security question is usually less about the prompt and more about the authority wrapped around the action.
- A finance analyst asks an agent to summarise quarterly performance from curated tables, where the agent can only read approved datasets.
- A support workflow uses an agent to draft responses from internal knowledge sources, with output review before publication.
- An operations team lets an agent generate SQL and execute a bounded query against a governed warehouse to accelerate investigation.
- A business user asks an agent to combine internal records and produce a report, creating a tradeoff between convenience and data minimisation.
- A workflow orchestrates follow-up tasks from an AI-generated decision, which is useful only when the downstream action boundaries are explicit.
That final tradeoff matters: the more the agent can act, the more carefully organisations must distinguish between read-only assistance and action-bearing automation.
Security Implications
The main failure mode is over-scoped authority. If a Cortex AI agent inherits access too broadly, it can expose data that the user did not intend to surface, or amplify a harmless query into an operational action. In practice, this can create confidentiality issues, unauthorised query paths, and weak accountability when an automated step is treated as if it were only an advisory system.
Misalignment between the agent’s permissions and its business purpose also creates governance drift. A workflow that is safe for summarisation may become unsafe once it is allowed to generate executable logic, join sensitive datasets, or pass results into another system. The observable symptom is often not a dramatic breach event but a gradual expansion in what the agent can see, infer, or trigger.
Security review should therefore focus on blast radius, not just model quality. When the agent sits close to governed data, the practical question is whether the surrounding controls still constrain what it can access, reveal, and hand off.
Domain and Governance Relevance
Cortex AI agents sit at the intersection of AI security, data governance, and identity control. They matter because the agent’s authority is usually inherited from the surrounding environment, which means access design, least privilege, and approval boundaries become part of the agent’s trust model. In other words, the agent is only as constrained as the identity and policy framework that governs its runtime.
For identity-heavy environments, the key governance issue is whether the agent is acting as a non-human actor with bounded purpose or as a convenient proxy for broader access. That distinction affects ownership, review, logging, and revocation. An agent that can query sensitive data or initiate tasks should be treated as an operational subject with a lifecycle, not as a passive interface.
For practitioners, the value is in aligning autonomy with explicit accountability rather than assuming model behaviour will self-limit. For broader AI governance context, NIST’s AI Risk Management Framework and the CSA MAESTRO agentic AI threat modeling framework both reinforce that autonomy, scope, and oversight must be designed together.
Risk and Threat Considerations
Cortex AI agents introduce material exposure because they combine natural-language intent with governed access and execution authority. The risk is not just incorrect output. It is that an agent may surface sensitive data, follow an unintended path, or be induced to perform actions that exceed the user’s original intent.
Failure mechanism: Excessive permissions, weak tool boundaries, or poorly constrained prompts can let the agent retrieve information or trigger workflows beyond the intended task. Adversarial inputs, prompt injection, and authority confusion are recognised mechanisms that can turn a helper into an access amplifier.
Impact: The result can be data leakage, unauthorised action, contaminated downstream decisions, or a control gap where automated behaviour is hard to attribute, review, or revoke.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, MITRE ATLAS and CSA MAESTRO address the attack surface, NIST AI RMF set the technical controls, and ISO/IEC 42001:2023 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A1 — Agentic Access Control | Cortex AI agents can execute actions, so authority scoping is central. |
| Recommendation — Restrict tool and data access to the agent's intended task scope. | ||
| MITRE ATLAS | AML.TA0001 — Prompt Injection | Agent outputs can be steered by adversarial instructions embedded in inputs. |
| Recommendation — Hunt for injected instructions that redirect the agent's behaviour. | ||
| NIST AI RMF | GOVERN — Govern | The term requires defined accountability and oversight for autonomous AI use. |
| Recommendation — Assign ownership and oversight before permitting the agent to act on governed data. | ||
| CSA MAESTRO | AIM-02 — Agentic Trust Boundaries | The core issue is how far the agent's trusted actions can extend. |
| Recommendation — Define and enforce trust boundaries around every agent action path. | ||
| ISO/IEC 42001:2023 | A.4 — Context of the organization | Agent deployment must fit the organisation's AI governance context. |
| Recommendation — Tie agent deployment to documented AI governance scope and accountability. | ||
Practitioner Guidance
Governance implication: Treat the agent as a governed non-human actor with a defined purpose, owner, and permission envelope. If its outputs can trigger action, the approval model must distinguish draft assistance from executable authority.
What to watch for: Pay close attention when the agent begins crossing boundaries from read-only retrieval into query generation, task orchestration, or handoff to other systems. That is where scope creep usually becomes a security problem.
Practitioner takeaway: The safest deployment pattern is narrow authority plus explicit review points, not broad trust in the model’s judgment.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 7, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
