Securely connecting Gemini Enterprise to Snowflake data

Google Cloud published a Data Analytics guide on October 28, 2026, by Cloud Data Engineer Pankaj Bajpai and AI Engineer Abhilash Adavi, that connects Gemini Enterprise to Snowflake under the signed-in user's permissions. Google Cloud Blog's report uses the Model Context Protocol (MCP) and the Google Agent Development Kit (ADK) so Snowflake Cortex can write the SQL. The guide presents that ADK architecture as the advanced custom-orchestration pattern.

Developers building multi-agent systems on Google Cloud are the audience: workflows that combine Snowflake insights with external enterprise tools, custom reasoning loops, or cross-platform state management in Gemini Agent Engine. Covered here are OAuth impersonation, the GenAI role, the Cortex Agent, the MCP server URL, and AUTH_ID in the Python ADK code. Direct Gemini Enterprise connections to Snowflake stay on the joint solutions for standard cases.

Securely connecting Gemini Enterprise: what actually changed

A business user can ask, "What were our top 5 selling items in Texas last quarter?" The ADK agent does not expose raw SQL to the client. It delegates generation and execution to a Snowflake Cortex Agent on the Snowflake MCP server. That server invokes the Cortex Agent through CORTEX_AGENT_RUN, backed by a Cortex Analyst semantic view. The Cortex Agent translates the question into SQL, runs it in Snowflake on the user's OAuth session and role privileges, and returns structured results to the ADK agent.

That path gives deterministic text-to-SQL mapped to corporate semantic definitions and keeps execution inside Snowflake's governed boundary. It reduces schema hallucinations and unvalidated SQL. The risk the setup is written to avoid is a generic service account: broad access that lets users bypass security restrictions. OAuth 2.0 performs user impersonation instead. Diagrams in the guide show trust boundaries and a numbered flow between the Gemini Enterprise app and Snowflake, with natural-language translation and governed execution delegated to the Cortex Agent over MCP.

Securely connecting Gemini Enterprise: how it works

Setup starts in Snowflake under ACCOUNTADMIN. The administrator creates or replaces a SECURITY INTEGRATION with TYPE = OAUTH, ENABLED = TRUE, OAUTH_CLIENT = CUSTOM, and OAUTH_CLIENT_TYPE = 'CONFIDENTIAL' so the client secret is protected. OAUTH_REDIRECT_URI is Google Cloud's handshake address, https://vertexaisearch.cloud.google.com/oauth-redirect. OAUTH_ISSUE_REFRESH_TOKENS = TRUE. OAUTH_REFRESH_TOKEN_VALIDITY = 7776000, so the connection can stay alive for 90 days, the maximum Snowflake allows. SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('SECURITY_INTEGRATION_NAME') returns the client ID and client secret Snowflake generated for that integration, which the Google Cloud configuration then uses.

SECURITYADMIN runs CREATE ROLE IF NOT EXISTS for the GenAI role and grants it to the business user. SYSADMIN grants USAGE on the database, schema, and warehouse, SELECT and REFERENCES on the semantic view, and SELECT on all tables in the schema. The physical tables behind the semantic view need SELECT, or query execution returns runtime errors. If base-table grants are forbidden, a Snowflake Secure View covers them, the semantic view is built on it, and Owner's Rights leave the GenAI role with SELECT only on the Secure View and the semantic view.

Securely connecting Gemini Enterprise: why it matters now

Snowflake OAuth tokens bind the user's DEFAULT_ROLE and DEFAULT_WAREHOUSE at the exact moment of authorization. If a user authorizes before those defaults are set, the session locks to the role available at that time. Queries then fail if the intended role lacks privileges. Before the user authorizes in Gemini Enterprise, ALTER USER sets DEFAULT_ROLE to the GenAI role and DEFAULT_WAREHOUSE to the warehouse. Authorization itself is one-time inside Gemini Enterprise. Afterward the user can revert both defaults to standard operational preferences, because the token already captured the GenAI role and warehouse.

The agent and MCP server are created with the database, schema, and SYSADMIN. CREATE OR REPLACE AGENT sets the comment to "Governed data assistant for business queries" and a PROFILE whose cortex_analyst semantic_models list holds the semantic view. CREATE OR REPLACE MCP SERVER exposes run_cortex_agent, type CORTEX_AGENT_RUN, identifier DATABASE_NAME.SCHEMA_NAME.AGENT_NAME, title "Cortex Agent Assistant". The tool description says it converts natural-language questions into SQL and executes them in Snowflake using the caller's OAuth session permissions. The guide says not to expose SYSTEM_EXECUTE_SQL to external clients, because that raw tool adds security surface and bypasses Cortex Agent governance.

Securely connecting Gemini Enterprise: who is affected

SECURITYADMIN must still GRANT USAGE on the agent and GRANT USAGE on the MCP server to the GenAI role. DESCRIBE MCP SERVER, or DESC MCP SERVER, on that database, schema, and server name returns the endpoint. The URL is https://org_name-account_name.snowflakecomputing.com/api/v2/databases/database_name/schemas/schema_name/mcp-servers/server_name. The ADK code requires that Snowflake-managed URL. Account administrators create the confidential OAuth client. The business user is the identity whose OAuth session and role privileges constrain every query. Developers writing the Google ADK agent are the ones who place that URL in Python.

In the Python ADK code, AUTH_ID is the unique identifier, for example snowflake_oauth_conn, and the agent uses it to extract the user's credentials. Custom orchestration fits teams that combine Snowflake with external enterprise tools, custom reasoning loops, or cross-platform state management in Gemini Agent Engine. A direct Gemini Enterprise connection to Snowflake, without those pieces, is the standard basic case and stays on the joint solutions. SQL placeholders, from the security integration name through the server name, are replaced per account.

Securely connecting Gemini Enterprise: what to watch

Three conditions make an otherwise complete setup fail. Authorizing in Gemini Enterprise before DEFAULT_ROLE and DEFAULT_WAREHOUSE point at the GenAI role and warehouse locks the OAuth session to the wrong role. SELECT on the semantic view without SELECT on the backing physical tables produces runtime errors when the Cortex Agent executes. Exposing SYSTEM_EXECUTE_SQL to an external client skips centralized governance and widens the security surface that CORTEX_AGENT_RUN is meant to close. The refresh-token ceiling remains 7776000 seconds, 90 days, even when OAUTH_ISSUE_REFRESH_TOKENS is TRUE on a CONFIDENTIAL client.

Reverting default role and warehouse after the one-time authorization does not retarget the token Snowflake already bound. The confidential integration, the secrets from SYSTEM$SHOW_OAUTH_CLIENT_SECRETS, the USAGE grants, and the resolved MCP URL all have to exist before the Python agent uses AUTH_ID to extract the user's credentials. Execution stays inside Snowflake: the Cortex Analyst semantic view supplies the corporate definitions, the caller's OAuth session supplies the privileges, and the ADK agent receives structured results rather than a raw SQL channel from Gemini Enterprise.