Schema Secure

What is Schema Secure? Schema Secure is a Native App that simplifies RBAC and automates schema-level access control in Snowflake. For every schema you select, it creates three standardized database roles with complete privilege sets—including future grants—so new objects automatically inherit the right permissions: READ_ONLY — Read access to all current and future objects USAGE and MONITOR on the schema SELECT on tables, views, materialized views, streams, etc. READ/USAGE on stages USAGE on functions, procedures, file formats, sequences, etc. READ_CREATE — Inherits READ_ONLY plus create privileges CREATE TABLE, VIEW, STAGE, FUNCTION, PROCEDURE, DBT PROJECT, etc. Everything needed to build new objects in the schema SCHEMA_OWNER — Inherits READ_CREATE plus ownership OWNERSHIP of the schema Automatically granted to SYSADMIN (following Snowflake best practices) Why Schema-Level? Object-level grants are too granular — they create audit complexity, slow onboarding, and require constant maintenance as objects are added Database-level grants are too broad — they result in over-privileged roles that fail security reviews Schemas naturally group related objects, making them ideal security boundaries. Why Schema Secure? One Click Setup — Select schemas, click a button, and all roles are created with complete privileges. No SQL to write or maintain. Future-Proof — Future grants ensure new objects automatically receive the right privileges. When Snowflake releases new object types, we update Schema Secure to include them. Standardized Pattern — Every schema follows the same three-role model. Predictable role names make auditing straightforward. How It Works Set up Schema Access Roles — Use the UI or CORE.SET_UP_SCHEMA_ACCESS_ROLES() to create the roles. Grant access — Grant the schema access roles to your functional roles: GRANT DATABASE ROLE ANALYTICS.SALES__READ_ONLY__SCHEMA_ACCESS_ROLE TO ROLE SALES_ANALYST__ROLE;

GRANT DATABASE ROLE ANALYTICS.SALES__READ_CREATE__SCHEMA_ACCESS_ROLE TO ROLE DATA_ENGINEER__ROLE; Getting Started After installation, the Streamlit interface guides you through granting the required procedure references. Full setup instructions are also available in the app's README under Settings → About the app.