VG
611ad214fe
Encode intent/decision/plan workflow for Snowflake platform delivery so engagements share a durable recipe instead of one-off LLM chats. Co-authored-by: Cursor <cursoragent@cursor.com>
9 lines
608 B
Markdown
9 lines
608 B
Markdown
# RBAC best practices (Sky Lattice blueprint)
|
|
|
|
- Prefer functional roles (analyst, loader, engineer) composed from access roles per zone.
|
|
- Never use `ACCOUNTADMIN` for day-to-day service automation after bootstrap.
|
|
- Restricted domains: analysts read `marts` by default; `curated` in prod needs override + decision.
|
|
- Environment isolation: default `database_per_env` unless the customer requires account-per-env (record a decision).
|
|
- Temporary exceptions must have `expires_on` when possible.
|
|
- Brownfield: leave legacy roles in `unmanaged` with a decision rather than silently rewriting them on day one.
|