How does Snowflake implement Role-Based Access Control (RBAC) and what are the system-defined roles?

In Snowflake's RBAC model, privileges are granted to roles, and roles are granted to users or other roles (creating a role hierarchy). A user acquires the union of all privileges from every role in their active role tree. At any moment, a session runs under one active role; the user can switch with USE ROLE.

Five system-defined roles exist in every account and cannot be dropped:

• ACCOUNTADMIN — highest privilege; manages billing, account parameters, all objects. Should be used sparingly and with MFA.
• SYSADMIN — manages all databases, schemas, warehouses, and objects. The recommended role for day-to-day data engineering work.
• SECURITYADMIN — creates and manages users and roles; grants and revokes privileges. Cannot read data.
• USERADMIN — creates users and roles (a subset of SECURITYADMIN's scope).
• PUBLIC — automatically granted to every user; assign here only objects you want universally accessible.

Best practice: create custom roles and grant them up to SYSADMIN so ACCOUNTADMIN retains full visibility through inheritance. Never do daily work as ACCOUNTADMIN.

-- Grant SELECT on a table to a custom role
GRANT SELECT ON TABLE sales.orders TO ROLE analyst_role;

-- Grant the warehouse to the role
GRANT USAGE ON WAREHOUSE reporting_wh TO ROLE analyst_role;

-- Assign the custom role to a user
GRANT ROLE analyst_role TO USER alice;

-- Grant the custom role UP to SYSADMIN for visibility
GRANT ROLE analyst_role TO ROLE SYSADMIN;

-- Inspect what privileges a role holds
SHOW GRANTS TO ROLE analyst_role;