Data platforms

Snowflake

Cloud data warehouse for analytics

Overview Context types Tools Use cases Connection Security

Overview

Snowflake is usually where the numbers actually live, and where an agent does the most damage if it guesses. Modus mines the schemas you select down to column level, learns which tables are really used and how they join, and keeps that understanding current as the warehouse changes.

What Modus reads

1Database
2Schema
3Table / View
4Column

You select the level Modus is allowed to mine. Everything below it is discovered automatically; everything outside it is never touched.

5context types mined

1agent tool groups

2connection methods

8security controls

Context types

Each object Modus mines produces typed context items, addressed by their position in the hierarchy. This is what an agent actually receives.

Schema metadata
The container Modus is scoped to: what lives inside it, how it is organised, and how much of it is actually used.
Table / View metadata
Names, descriptions, column lists, types, keys, and the join paths Modus observes between objects.
Table / View samples
A small, classified sample of representative rows so agents can tell an ISO date from an epoch, and a status enum from free text.
Column statistics
Distinct counts, null ratios, ranges, and top values per column, so an agent knows which column is the real grain.
Column samples
Representative values per column, redacted whenever classification flags them as sensitive.

Example context item

snowflake_table_metadata

ANALYTICSFINANCEFCT_ORDERS

Object: Table · 41 columns · ~18.4M rows
Grain: One row per order line
Joins with: DIM_CUSTOMER.customer_id · DIM_PRODUCT.sku
Key columns: order_id (PK) · customer_id · net_amount_usd
Classification: Sensitive: billing_email · Flagged: ship_postcode

Tools

Tools are granted per skill, never globally. Anything that changes state in Snowflake is marked as a write and stops for human approval.

SQL Runner
Run governed read queries against the schemas a skill is scoped to. Statement categories (SELECT, INSERT, UPDATE, DELETE, CREATE) are granted per skill, so most agents get SELECT and nothing else.

Common use cases

Answer "how is net revenue calculated" with the real table, the real filter, and the columns that matter.
Give a text-to-SQL agent the join paths and grain it needs so it stops inventing keys.
Route the finance team through a restricted Snowflake role while everyone shares one connection.
Retire a table without breaking agents, because Modus already knows what depended on it.

Connection method

Connect once. Modus stores credentials in a managed secret store, rotates what it can, and never asks an agent to handle them.

Key-pair authentication

RSA key-pair JWT against a dedicated Modus service user. The recommended setup: no password to rotate, no interactive login.

Username & password

Classic credential auth for a read-only service user, scoped to a warehouse and role you choose.

Security & governance

Governance is applied once, at the layer every agent runs through, so it holds no matter which agent asks.

Metadata-first mining

Modus learns from structure and usage, not bulk data. Raw records stay in your environment; only the metadata needed to understand the system is stored.

Scoped selection

You choose exactly which schemas, folders, spaces, or boards Modus is allowed to see. Nothing outside the selection is ever mined.

Data classification

Sampled values are scanned for PII, financial, health, credential, and government-ID patterns, then classified as Sensitive, Flagged, or Non-sensitive. Your own overrides win over the defaults.

Group access by sensitivity

Map your identity groups to sensitivity tiers so each team only ever composes context at or below its clearance.

Read-only by default

Mining runs on a read-only credential. Any tool that writes back is a separate, explicitly granted action.

Query cache

Repeat read queries can be served from a governed cache with a configurable TTL, cutting warehouse cost and latency without bypassing access controls.

IP allow list

Modus connects from fixed egress IPs you allowlist in your network or cloud firewall, so the warehouse never has to accept traffic from the open internet.

Connection profiles

One connection, different access per group. Each group is routed through its own warehouse role, so source-side grants keep doing their job.

Put Snowflake to work.

Connect it in minutes and give every agent a governed understanding of what is inside, without moving a single row of data.

Book a demo